Dev-related docs
Code Review Code Style Contribute Deprecate Internals New protocol Release procedure Roadmap Run tests Source code Specifications Test Clutch Test curl Test case file format Tests Overview Vulnerability Disclosure Policy
Current status
Autobuilds Daily snapshots Dashboard Feature window git stats Issues (github) Pull requests (github) Release Notes
curl / Development / Deprecate
Related:
Internals
Mailing Lists
Known Bugs
Report Bugs
TODO

Items to be removed from future curl releases

If any of these deprecated features is a cause for concern for you, please email the curl-library mailing list as soon as possible and explain to us why this is a problem for you and how your use case cannot be satisfied properly using a workaround.

TLS-SRP Authentication

Transport Layer Security Secure Remote Password is a TLS feature that does not work with TLS 1.3 or QUIC and is virtually unused by curl users and in general.

TLS-SRP support gets removed in August 2026.

drop SMB support

The SMB protocol has weak security and is rarely used these days.

SMB support gets removed in September 2026.

drop NTLM support

The NTLM authentication method has weak security and is rarely used these days. It has been deprecated by Microsoft and does not work over HTTP/2 or HTTP/3.

NTLM support gets removed in September 2026

Local crypto implementations

Since the dawn of time, curl bundles code for a few crypto and hash algorithms in order to enable functionality for builds without TLS libraries. This list includes MD4, MD5, SHA256, SHA256_512 and perhaps something more.

Meanwhile, curl is almost always built to use a TLS/crypto library which for sure has better maintained and better performing versions of these algorithms.

Also, the local curl implementations are not as widely tested since curl builds without TLS are rare.

Since these implementations are going away, a good idea is to verify ahead of time that builds using your preferred TLS library use the crypto functions provided by that library and are not bundled by curl.

The removal of local crypto functions subsequently disables some functions in future curl versions when built without TLS support. For example Digest.

Local crypto gets removed in October 2026.

Past removals