> curl 8.20.0

You always find the new curl releases on the curl site! Release presentation At 10:00 CEST (08:00 UTC) I will do my transitional live-streamed video presentation of curl 8.20.0 on my twitch channel. Numbers the 274th release8 changes49 days (total: 10,761)282 bugfixes (total: 13,922)521 commits (total: 38,545)0 new public libcurl function (total: 100)0 new curl_easy_setopt() option (total: 308)0 new curl command line option (total: 273)73 contributors, 45 new (total: 3,664)28 authors, 12 new (total: 1,463)8 security fixes (total: 188) Security As mentioned elsewhere, the security reporting volume has been intense lately. We publish eight new curl vulnerabilities this time. CVE-2026-7168: cross-proxy Digest auth state leak CVE-2026-7009: OCSP stapling bypass with Apple SecTrust CVE-2026-6429: netrc credential leak with reused proxy connection CVE-2026-6276: stale custom cookie host causes cookie leak CVE-2026-6253: proxy credentials leak over redirect-to proxy CVE-2026-5773: wrong reuse of SMB connection CVE-2026-5545: wrong reuse of HTTP Negotiate connection CVE-2026-4873: connection reuse ignores TLS requirement Changes now uses a thread pool and queue for resolving NTLM is disabled by default dropped support for CMake 3.17 and older dropped support for < c-ares 1.16.0 SMB is disabled by default added CURLMNWC_CLEAR_ALL for all network changes dropped RTMP support Bugfixes The official count says over 260 bugfixes were merged in this 49 day cycle. See the changelog for all the details. Pending Removals Planned upcoming removals include: local crypto implementations NTLM SMB TLS-SRP support If you are concerned about any of these, speak up on the curl-library ASAP. Next release Unless we messed up this one and need to do a patch release, the pending next release is scheduled to happen on June 24.