Download curl from curl.se.
Release presentation
Numbers
the 271st release
11 changes
56 days (total: 10,092)
448 bugfixes (total: 12,537)
699 commits (total: 36,725)
2 new public libcurl function (total: 100)
0 new curl_easy_setopt() option (total: 308)
1 new curl command line option (total: 273)
69 contributors, 35 new (total: 3,534)
22 authors, 5 new (total: 1,415)
1 security fixes (total: 170)
Security
CVE-2025-10966: missing SFTP host verification with wolfSSH. curl’s code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.
Changes
We drop support for several things this time around:
- drop Heimdal support
- drop the winbuild build system
- drop support for Kerberos FTP
- drop support for wolfSSH
And then we did some other smaller changes:
- up the minimum libssh2 requirement to 1.9.0
- add a notifications API to the multi interface
- expand to use 6 characters per size in the progress meter
- support Apple SecTrust – use the native CA store
- add
--knownhoststo the command line tool - wcurl: import v2025.11.04
- write-out: make
%header{}able to output all occurrences of a header
Bugfixes
We set a new project record this time with no less than 448 documented bugfixes since the previous release.
The release presentation mentioned above discusses some of the perhaps most significant ones.
Coming next
There a small set of pull-requests waiting to get merged, but other than that our future is not set and we greatly appreciate your feedback, submitted issues and provided pull-requests to guide us.
If this release happens to include an annoying regression, there might be a patch release already next week. If we are lucky and it doesn’t, then we aim for a 8.18.0 release in the early January 2026.