{"id":30615,"date":"2026-09-02T07:52:46","date_gmt":"2026-09-02T05:52:46","guid":{"rendered":"https:\/\/daniel.haxx.se\/blog\/?p=30615"},"modified":"2026-09-02T11:24:13","modified_gmt":"2026-09-02T09:24:13","slug":"curl-8-22-0","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2026\/09\/02\/curl-8-22-0\/","title":{"rendered":"curl 8.22.0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Welcome to this new release. Get it as always from <a href=\"https:\/\/curl.se\">https:\/\/curl.se<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you rather want a security-patched older release branch, stay tuned for the follow-up <a href=\"https:\/\/rock-solid.curl.dev\/\">Rock-solid curl<\/a> announcement within a few days.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Release presentation<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"curl 8.22.0 with Daniel Stenberg\" width=\"474\" height=\"267\" src=\"https:\/\/www.youtube.com\/embed\/Iz4x-jMcmWo?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Numbers<\/h2>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\">the 276th release<br>6 changes<br>70 days (total: 10,887)<br>302 bugfixes (total: 14,489)<br>525 commits (total: 39,608)<br>0 new public libcurl function (total: 100)<br>4 new curl_easy_setopt() option (total: 312)<br>4 new curl command line option (total: 278)<br>85 contributors, 55 new (total: 3,786)<br>43 authors, 29 new (total: 1,518)<br>9 security fixes (total: 215)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Associated with this release, we publish ten new CVEs. Nine of them are for curl and libcurl, and one is for wcurl.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-13608.html\">CVE-2026-13608<\/a>: OpenLDAP SASL authentication bypass<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-18924.html\">CVE-2026-18924<\/a>: HTTP\/2 server push UAF<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-19931.html\">CVE-2026-19931<\/a>: Negotiate ambient user conn reuse<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-80229.html\">CVE-2026-80229<\/a>: OpenSSL provider use-after-free<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-80230.html\">CVE-2026-80230<\/a>: OpenSSL pinning bypass<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-80231.html\">CVE-2026-80231<\/a>: native CA store conn reuse<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-80255.html\">CVE-2026-80255<\/a>: secure cookie attribute bypass with tab<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-82208.html\">CVE-2026-82208<\/a>: wolfSSL CA-cache hit overrides callback<\/li>\n\n\n\n<li><a href=\"https:\/\/curl.se\/docs\/CVE-2026-82209.html\">CVE-2026-82209<\/a>: domain-scoped PSL domain cookie<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The wcurl one:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/curl.se\/docs\/CVE-2026-80256.html\">CVE-2026-80256<\/a>: wcurl backslash bypass<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Changes<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>added support for Apple GSS Framework<\/li>\n\n\n\n<li>added API guards<\/li>\n\n\n\n<li>new RFC 9421 HTTP Message Signatures support (experimental)<\/li>\n\n\n\n<li>blocks NTLM fallback in SPNEGO negotiation<\/li>\n\n\n\n<li>dropped support for TLS-SRP<\/li>\n\n\n\n<li>added option to use Apple fast UDP<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Coming removals<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTP\/2 Server Push<\/li>\n\n\n\n<li>local crypto implementations<\/li>\n\n\n\n<li>NTLM<\/li>\n\n\n\n<li>SMB<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Next<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We plan the next curl release to happen at the end of October unless there are some bad regressions reported against 8.22.0.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Welcome to this new release. Get it as always from https:\/\/curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation Numbers the 276th release6 changes70 days (total: 10,887)302 bugfixes (total: 14,489)525 commits (total: 39,608)0 new public libcurl function (total: 100)4 new &hellip; <a href=\"https:\/\/daniel.haxx.se\/blog\/2026\/09\/02\/curl-8-22-0\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">curl 8.22.0<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":30619,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[33,95],"class_list":["post-30615","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-curl","tag-curl-and-libcurl","tag-release"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/30615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=30615"}],"version-history":[{"count":10,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/30615\/revisions"}],"predecessor-version":[{"id":30630,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/30615\/revisions\/30630"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media\/30619"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=30615"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=30615"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=30615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}