On March 11, after more than two months of development and 538 commits, version 8.19.0 (the 273rd) of the cross-platform console utility and library was released. curl, written in C and distributed under a license. curl.
Key changes
Security
- The vulnerability reward program has been discontinued, but that hasn't stopped people from finding vulnerabilities in curl:
- CVE-2026-1965 – improper reuse of HTTP Negotiate connection;
- CVE-2026-3783 – token leakage with redirection and netrc;
- CVE-2026-3784 – improper reuse of proxy connection with credentials;
- CVE-2026-3805 – use after free in SMB connection reuse.
Other changes
- added CMake option CURL_BUILD_EVERYTHING;
- added initial support for MQTTS;
- added support for fractional values in the –limit-rate and –max-filesize options;
- the -J option now uses the redirection name as a fallback;
- removed OpenSSL-QUIC support.;
- on Windows, curl can now be compiled to use the native CA certificate store by default;
- the minimum supported version of Windows is now Vista.
Upcoming removals in future versions (see details):
- NTLM support will become optional;
- RTMP support will be removed;
- SMB support will become optional;
- c-ares library support up to version 1.16 will be removed;
- CMake version 3.17 and earlier support will be removed;
- TLS-SRP support will be removed.
Source: linux.org.ru
