# curl 8.22.0

- Product: curl (https://whatsnew.fyi/product/curl)
- Vendor: curl
- Date: 2026-09-02
- Version: 8.22.0
- Original notes: https://curl.se/ch/8.22.0.html
- Permalink: https://whatsnew.fyi/product/curl/releases/8.22.0
- Labels: Platforms: Desktop

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add support for Apple GSS Framework in gssapi
- **added** — Add API guards for hardening
- **added** — Add RFC 9421 HTTP Message Signatures support
- **added** — Add option to use Apple fast UDP in vquic
- **changed** — Block NTLM fallback in SPNEGO negotiation
- **removed** — Drop support for TLS-SRP
- **fixed** — Continue after unknown parameters in altsvc
- **fixed** — Retry link-local ipv6 if missing scope id in asyn-thrdd
- **fixed** — Always use local inet_pton() and inet_ntop() implementations in build
- **fixed** — Enable thread-safe getaddrinfo() for OpenBSD in build
- **fixed** — Fix event-based connection shutdown in cfilters
- **fixed** — Avoid broken NetBSD SOCK_NONBLOCK in cf-socket
- **fixed** — Disable TCP SYN retransmissions for localhost on Windows in cf-socket
- **fixed** — Fix bounds check in read_https_alpn_part() in dnsd
- **fixed** — Fix TLS session reuse on the data connection in FTP
- **fixed** — Support directory listing on Windows in file
- **fixed** — Fix partial sends of CRLF in gopher
- **fixed** — Fix NULL deref when non-:status header arrives before :status in h3-proxy
- **deprecated** — HTTP/2 Server Push gets removed in March 2027

curl / Docs / Releases / Changes in 8.22.0
Related: Daily Snapshots Source repo Release log Pending Release
🠰 8.21.0 all changes pending release
#### Changes in 8.22.0 - September 2 2026
8.22.0
8.22.0
Changes:
- gssapi: add support for Apple GSS Framework
- hardening: add API guards
- RFC 9421 HTTP Message Signatures support
- spnego: block NTLM fallback in SPNEGO negotiation
- TLS: drop support for TLS-SRP
- vquic: add option to use Apple fast UDP
Bugfixes:
- altsvc: continue after unknown parameters
- asyn-thrdd: retry link-local ipv6 if missing scope id
- autotools: minor fixes and improvements
- build: always use local `inet_pton()`/`inet_ntop()` implementations
- build: assume POSIX `select()` is available
- build: clear `Require.private` for static-only builds in `libcurl.pc`
- build: drop `dirent.h` and `opendir()` detections on Windows
- build: drop detecting `gettimeofday()` on Windows
- build: drop superfluous `STDC_HEADERS` macro
- build: enable thread-safe `getaddrinfo()` for OpenBSD
- build: minor debug option message fixes/improvements
- build: require `!NDEBUG` for debug-enabled (aka development) builds
- build: strip duplicate spaces after `Libs.private:` in `libcurl.pc`
- build: strip trailing spaces from `libcurl.pc`
- cd2nroff: fix backslashes for 4-space indent lines
- cd2nroff: stricter checks for asterisks for italics
- cf-ngtcp2-cmn: de-duplicate `ngtcp2_conn_client_new()` call code
- cf-ngtcp2-cmn: initialize new callback ptr for ngtcp2 1.24.0+
- cf-socket: avoid broken NetBSD SOCK_NONBLOCK
- cf-socket: disable TCP SYN retransmissions for localhost on Windows
- cfilters: fix event-based connection shutdown
- clock: save one call
- cmake/FindLibgsasl: fix to set `LIBGSASL_VERSION` with pkg-config detection
- cmake: check libgsasl version at configure time
- cmake: dedupe expressions into local vars in `cmake_uninstall.in.cmake`
- cmake: fix not to build `tunits` when `BUILD_CURL_EXE=OFF`
- cmake: flatten build tree, tidy up base dir variables
- cmake: minor improvements to `cmake_uninstall.in.cmake`
- cmake: optimize OpenSSL fork detection
- cmake: replace `remove` command with `rm` and pass arg safely
- cmake: robustify base path in local file reference
- cmake: stop probing unused `float.h` for `STDC_HEADERS`
- cmake: use built-in variable and target property dump functions with CMake 4.5+
- config-riscos.h: delete handcrafted RISC OS config header, in favor of autotools
- config-win32.h: drop UWP, c-ares, simplify more
- config-win32.h: limit use to MSVC IDE Project builds
- configure: clarify --enable-debug option
- configure: fix misleading error messages
- configure: link `-lcrypt32` instead of `-lm` for wolfSSL on Windows
- configure: only check in the watt library if WATT_ROOT is set
- configure: remove double check for GnuTLS
- configure: set ldap lib to no by default for non-finds
- conncache: apply multi limits to transfers using a shared pool
- conncache: conn upkeep/alive: move and enhance
- conncache: connection alive checks intervals
- conncache: don't assume curl_off_t increment wrap-around
- conncache: guess maxconnects different
- connect: connection close tweaks
- connect: only set connect timer on first socket
- connection reuse: age check
- connection reuse: check SSL configs when doing a scheme upgrade
- connections: use admin handles only for maintenance
- content_encoding: exact-match the identity transfer-coding token
- content_encoding: give a clear error on multi-member gzip
- cookie: cookies set for an exact PSL domain is host-only
- cookie: improve TAB handling
- cookie: refuse to load cookies set against a PSL domain
- CREDENTIALS.md: remove comment about empty user/pass
- ctype: exclude control bytes from ISPRINT and ISGRAPH
- curl: help category cleanups
- curl_gssapi: document/update feature availability
- curl_threads: always use native threads/mutex on Windows
- curl_trc: remove unused expire timers
- curl_url_set.md: expand the CURLU_NO_AUTHORITY description
- curl_ws

_[Truncated at 4000 characters — full notes: https://curl.se/ch/8.22.0.html]_