curl / Development / Pending Release Notes
Pending RELEASE-NOTES for the upcoming release
This is work in progress and seeing changes before the release goes public on 2026-10-14.
Changes:
- lib: CURL_GLOBAL_WIN32 -> CURL_GLOBAL_WINSOCK
- SMB: drop support
- tool_cb_wrt: inject the no-clobber number before the extension
- tool_cb_wrt: try up to .9999 when no-clobbering
Bugfixes:
- base64: avoid repeated input loads when encoding
- base64: optimize decode lookup table and quantum loop
- build: convert HAS_TIME_T_UNSIGNED to a compile-time check
- build: drop `HTTP_ONLY` option
- capsule: reject a capsule that can never be buffered
- cf-h1-proxy: reset chunk state on new request
- cf-h1-proxy: stricter status line parsing
- cf-ngtcp2-proxy: check for stream close on rx win update
- cf-ngtcp2-proxy: fix rx flow control
- cf-socket: clamp keepalive seconds-to-milliseconds conversions
- clang-tidy: merge nested `if()`s
- config2setopts: always set the security options for SCP/SFTP
- conncache: avoid evicting connect-only connections
- conncache: remove bundle dest
- connectdata: use less curltime
- cookie: accept slightly longer lines in cookie jars
- cookie: ignore individual cookie errors when loading
- cshutdown: make it smaller
- curl_addrinfo: drop redundant parentheses
- curl_easy_send/recv: check pointer arg
- curl_fopen: restore the uid and gid checks
- curl_formadd.md: mention the strlen() for names as well
- CURLINFO_EFFECTIVE_URL.md: mention a short lifetime
- CURLOPT*ISSUERCERT*: not verified cryptographically
- CURLOPT_POSTFIELDSIZE.md: improve wording
- CURLOPT_SHARE.md: remove bad explanation for cookie sharing
- CURLOPT_SSL_CTX_FUNCTION.md: client cert caveats
- cw-out: avoid O(n^2) work while buffering paused output
- cw-out: recheck callbacks for each call
- cw-pause: fix O(N^2) list traversal in cw_pause_flush
- digest: check peer equality for staleness
- digest: fix maximum length quoted value parsing
- digest: parse without storing 'value' in local buffer
- digest: quote the digest-uri param as well
- dnscache/conncache tweaks
- docs: add the missing .html to the url-encode book link
- doh: reject undersized HTTPS RDATA
- dynhds: grow header array geometrically
- easy: duplicating a zero byte memory area needs no malloc
- easy: make ca_cache_timeout standalone
- easy: validate buffer pointer in curl_easy_recv and curl_easy_send
- escape: polish encoding and decoding for speed
- escape: use hex-pair lookup in curl_easy_escape
- examples: clean up crawler link parsing resources
- fnmatch: replace recursive matcher with iterative greedy algorithm
- formdata: reject a negative content length in curl_formadd
- ftp: require TLS on the data connection for implicit FTPS
- ftp: tighten use_ssl check for conn reuse
- ftp: URL encode file names when wildcarding
- ftplistparser: no more overwriting set.write_func
- ftplistparser: when wildcarding, skip files with slashes
- getinfo: make sure CURLINFO_EFFECTIVE_URL does not contain creds
- getinfo: make sure CURLINFO_REDIRECT_URL does not contain creds
- getparam: switch off CONNECT headers when using -J
- glob: reduce the number of allocations for URLs that don't need globbing.
- global_init: tidy up, simplify, fix issues
- gtls: no early return on verify fail
- happy eyeballs: bound work from many duplicate/failing addresses
- hash: change key arguments to const
- hash: vary bucket placement across process runs
- headers: avoid O(n^2) rescans in curl_easy_nextheader()
- hsts: cap max-age to two years
- hsts: on load, only remove exact duplicates
- HTTP-CONNECT: do not react to 401 responses
- http2: changes in error handling
- http2: don't send a CURLE_SEND_ERROR after a valid http2 response
- http2: initialize URL handle for server pushes
- http2: update a refused stream's error after GOAWAY
- http: abide to close-rules when transfer-encoding off
- http: ignore Proxy-Authenticate unless the response comes from a proxy
- http: only enable Negotiate/NTLM to allowed origins
- http: reject resumed uploads
- httpsig-key.md: correct the generating Ed25519 keys commands
- httpsrr+ech: check target and port
- if2ip: check interface name case sensitive
- imap: compare selected mailbox names case-sensitively
- inet_pton: reject a colon that ends an IPv6 address
- KNOWN_BUGS: drop the empty error buffer entry, it no longer happens
- ldap: base64-encode a non-SAFE DN and reject a control-byte type name
- lib: connection shutdown, cleanup code
- lib: make private functions static and remove unused code
- lib: reject internal handles in the multi/easy public API
- libssh2: match hashed known_hosts entries by host
- libssh2: skip repeat checkp() for already-absent hashed key types
- libssh: work with empty priv_key
- mbedtls: fix ticket handling
- mbedtls: resend length check
- mime: bound Curl_mime_duppart() recursion depth
- mime: bound Curl_mime_prepare_headers() recursion depth
- mime: do curl_mime_free() non-recursively
- mprintf: avoid scanning strings twice for unbounded %s
- mprintf: stage output and emit it in runs
- mprintf: use size_t width for the bare Windows %I modifier
- mqtt: drain queued output before advancing the state machine
- mqtt: remaininglength check for 32-bit systems
- mulit_ev: remove socket references on forget
- multi-event: fix timeout of pending transfers
- multi: reduce struct size with small cleanups
- multi: remove redundant completion message list
- multi: store timeout epoch as whole seconds
- multi_ntfy: fix handling of more than 128 notifications in a batch
- multi_ntfy: replace enabled bitset with inline flags
- multihandle: some easy shrinks
- netrc: empty quoted values now produce a valid empty string
- netrc: survive comment-only .netrc file
- ngtcp2: shrink max sendbuf
- openldap: hand it a dup'd socket, not curl's own
- openssl/gtls: reject CRLfile with native CA store, matching rustls
- openssl: use non-deprecated API for MD5/MD4
- os400: document curl_formadd_CCSID multi-chunk peculiarity
- os400: restore HAVE_FCHMOD
- ossl_verifyhost: remove assumption of null-termination of ASN1_STRING.
- output-dir.md: expand on its behavior
- parsedate: find day names, months and time zones faster
- parsedate: remove the unused leading three letters
- peer: parsing a zoneid as number fix
- peer: preserve ipv6 props from "connect-to"
- perf-tests: output two-digital decimals always
- pingpong: add a max loop counter for Curl_pp_readresp
- pytest: check server status without ssl verify
- rtsp: accept a Content-Length body on methods that expected none
- rtsp: do not send a learned session id to another origin
- runtests: Added runnernums in order to have O(1) lookup
- schannel: auto_client_cert conn matching
- schannel: clear borrowed sslContext on close
- socks: support CURLAUTH_ONLY in CURLOPT_SOCKS5_AUTH
- socks: track SOCKS5 authentication per socket, not per connection
- socksd: count connections per test, widen the method2 sentinel
- ssl: dedup ssl_fsslctx
- ssls: validate input arguments in import, export, and unpack
- strparse: speed up number parsing
- sws: fix connection-monitor for connections closed before a request
- telnet: make it work through proxy tunnels
- test 1605: move from unit to libtest
- test1399: improve reliability
- test1679: unset `SSL_CERT_FILE`, use `TESTNUMBER`
- test: restore the old test 1609 as 3271
- tftp: verify direction in a few places
- tool: (re)set SSL verification in --libcurl output
- tool: buffer headers before remote filename selection
- tool_doswin: recognize superscript numbers as reserved
- tool_easysrc: reset the handle between --next operations
- tool_getparam: do not print the value of a redacted argument
- tool_help: guard category[2] access when category is bare "-"
- tool_ipfs: keep the path percent-encoded when rewriting to the gateway
- tool_operate: clear the retry flag when the output file fails
- tool_operate: set stdin non-blocking unconditionally
- u8_strset, u32_ptrset: fix boundaries handling
- uint-bset: skip unused slots when counting
- uint-table: add remove-max precaution
- url: match connections without force reuse and candidates
- url: ntlm/negotiate, prohibit connection reuse on follows
- urlapi: make curl_url_dup() copy the guessed_scheme flag
- urlapi: normalize legacy numeric IPv4 hosts set via CURLUPART_HOST
- urlapi: return NULL from curl_url_dup() when given a NULL handle
- urlapi: run the urlparser perf test faster
- urldata: remove conn->given
- urldata: remove ssl_primary_config from easy handle
- vdns: announce resolver start before the HTTPS RR query is sent
- vquic: fix preprocessor check for old Darwin versions
- vssh: do not busy-loop in blocking state machine without a timeout
- vtls: fix Curl_cert_hostcheck when the pattern is not a C string
- warnless: dedupe Intel compiler warning suppression pragmas
- wolfssl: remove BIO destroy callback
- ws: do not auto-pong in raw mode
- x509: stricter parsing
Contributors:
1rhino2 on hackerone, Adam Shirt, Andreas Westin, Artem Prilutskiy, Aviv Engelberg, Axel Mierczuk, Bobbeh Rhino, bupt-Yy-young on github, Charles Muehlberger, Christian Hesse, Christian Ullrich, Claude, Dan Fandrich, Daniel Lang, Daniel Stenberg, David Benjamin, Fengxiaoxx on github, Fernando Gallardo, Filippo Tedeschi, Florent Castelli, Fredrik Blau, Huang Yiheng, Ilias Aberkane, Jorge Rocamora, Joshua Rogers, ldm0, Luna Tong, Martin Dukek, Max Dymond, Mihai-Gabriel Marin, minnnjuuu, Muhamad Arga Reksapati, OSS-Fuzz, Paolo Ganci, Patrick Monnerat, rawsun007, Ray Satiro, renovate[bot], Rhino, Richard Payne, Ron Kuper, Roshan Ramani, Rudolf Polzer, Samuel Henrique, Sebastian Raase, Skye Soss, Stanislav Fort, Stefan Eissing, Stephen Psaradellis, szedenik-adam on github, Thanniru Sai Teja, Tyler Yankee, Un1q32, Viktor Szakats, xhon-pelushi, Yechan Bae