> curl 8.19.0

Release presentation Welcome to the curlhacker stream at 10:00 CET (09:00 UTC) today March 11, 2026 for a live-streamed presentation of curl 8.19.0. The changes, the security fixes and some bugfixes. Numbers the 273rd release8 changes63 days (total: 10,712)264 bugfixes (total: 13,640)538 commits (total: 38,024)0 new public libcurl function (total: 100)0 new curl_easy_setopt() option (total: 308)0 new curl command line option (total: 273)77 contributors, 48 new (total: 3,619)37 authors, 21 new (total: 1,451)4 security fixes (total: 180) Security We stopped the bug-bounty but it has not stopped people from finding vulnerabilities in curl. CVE-2026-1965: bad reuse of HTTP Negotiate connection CVE-2026-3783: token leak with redirect and netrc CVE-2026-3784: wrong proxy connection reuse with credentials CVE-2026-3805: use after free in SMB connection reuse Changes We stopped the bug-bounty. It’s worth repeating, even if it was no code change. The cmake build got a CURL_BUILD_EVERYTHING option Initial support for MQTTS was merged curl now supports fractions for –limit-rate and –max-filesize curl’s -J option now uses the redirect name as a backup we no longer support OpenSSL-QUIC on Windows, curl can now get built to use the native CA store by default the minimum Windows version curl supports is now Vista (up from XP) Pending removals The following upcoming changes might be worth noticing. See the deprecate documentation for details. NTLM support becomes opt-in RTMP support is getting dropped SMB support becomes opt-in Support for c-ares versions before 1.16 goes away Support for CMake 3.17 and earlier gets dropped TLS-SRP support will be removed Next We plan to ship the next curl release on April 29. See you then!