25 years on Apple computers

Exactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system. The one they later would rename to macOS.

Exactly twenty-five years ago today. Within all their fancy release presentations and videos there are barely no mentions of curl. In their technical notes page, there is just this short single line with not a lot of explanations:

Ever since then, curl has been an established component, present in every version and every install of macOS done through the decades. When Apple later created iOS, iPadOS, WatchOS etc they also adopted libcurl into their operating systems. Never to provide the API to users, but to empower their own applications and services. (But I have no specific date logged anywhere when that started.)

The first curl version Apple shipped in macOS was curl 7.7.2 which was released in April that same year.

Apple has never used a super recent curl version but they have updated it reasonably well I would say. Sometimes less good.

We are proud to have been a part of the Internet evolution all this time. We are happy that Apple, even if merely implied, has validated us and our way of doing things.

We have never worked with Apple, never received sponsorship by Apple, not had them as customers and except a few rare and mostly failed attempts there have never been any communication between us. We ship a freely available Open Source product that they use and bundle in their products. (It is their choice and right.)

curl 8.22.0

Welcome to this new release. Get it as always from https://curl.se.

If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days.

Release presentation

Numbers

the 276th release
6 changes
70 days (total: 10,887)
302 bugfixes (total: 14,489)
525 commits (total: 39,608)
0 new public libcurl function (total: 100)
4 new curl_easy_setopt() option (total: 312)
4 new curl command line option (total: 278)
85 contributors, 55 new (total: 3,786)
43 authors, 29 new (total: 1,518)
9 security fixes (total: 215)

Security

Associated with this release, we publish ten new CVEs. Nine of them are for curl and libcurl, and one is for wcurl.

The wcurl one:

CVE-2026-80256: wcurl backslash bypass

Changes

  • added support for Apple GSS Framework
  • added API guards
  • new RFC 9421 HTTP Message Signatures support (experimental)
  • blocks NTLM fallback in SPNEGO negotiation
  • dropped support for TLS-SRP
  • added option to use Apple fast UDP

Coming removals

  • HTTP/2 Server Push
  • local crypto implementations
  • NTLM
  • SMB

Next

We plan the next curl release to happen at the end of October unless there are some bad regressions reported against 8.22.0.