Dependencies

Third-party libraries curl can link against. Most are optional. The authoritative list of supported minimum versions is docs/INTERNALS.md; this page collects them in one place.

TLS / cryptography

Library	Min version	Files
OpenSSL (and forks: LibreSSL, BoringSSL, AWS-LC, quictls)	OpenSSL 3.0.0, LibreSSL 2.9.1	lib/vtls/openssl.c
GnuTLS	3.6.5	lib/vtls/gtls.c
mbedTLS	3.2.0	lib/vtls/mbedtls.c
wolfSSL	5.0.0	lib/vtls/wolfssl.c
Rustls (rustls-ffi)	recent	lib/vtls/rustls.c
Schannel	system	lib/vtls/schannel.c, lib/vtls/schannel_verify.c
Apple SecTrust (Security framework)	system	lib/vtls/apple.c

HTTP/2 and HTTP/3

Library	Min version	Purpose
nghttp2	1.15.0	HTTP/2 framing
ngtcp2 + nghttp3	recent	QUIC + HTTP/3
quiche	recent	Alternative HTTP/3 implementation

SSH

Library	Min version	Purpose
libssh2	1.9.0	Default SSH backend
libssh	0.9.0	Alternative SSH backend

Compression / encoding

Library	Min version	Purpose
zlib	1.2.5.2	gzip/deflate
brotli	1.0.0	Content-Encoding: br
zstd	1.0	Content-Encoding: zstd

Async DNS

Library	Min version	Purpose
c-ares	1.16.0	Async DNS without threads

Authentication

Library	Purpose
MIT Kerberos	Kerberos / GSSAPI on Unix
Heimdal	Was supported, removed Nov 2025
Windows SSPI	NTLM, Negotiate, Digest on Windows
libgsasl	Optional SASL backend (lib/vauth/gsasl.c)

Other

Library	Purpose
libidn2	International Domain Name handling
libpsl	Public Suffix List for cookie scoping
OpenLDAP	LDAP and LDAPS

Build tools

These are required when building from a git checkout (release tarballs include the generated artefacts).

Tool	Min version
GNU autoconf	2.59
GNU automake	1.7
GNU libtool	1.4.2
GNU m4	1.4
CMake	3.18
perl	5.8 (5.22 on Windows)
Python	3.x (only for select test scripts)
clang-tidy	17.0.0 (recommended 19.1.0+)
Visual Studio	2010 10.0 (oldest supported)

Bindings

curl is also depended on by ~40 third-party language bindings (Python via pycurl, PHP, Ruby, Lua, Rust, ...). The catalogue is docs/BINDINGS.md. These do not appear in the build dependency tree but are part of the project's ecosystem and explain why ABI stability matters so much.

How dependency resolution works

configure.ac and CMakeLists.txt probe for libraries via pkg-config first, then by direct header/library probing. Each TLS backend, SSH backend, HTTP/2/3 backend, etc. is conditionally compiled and behaviour is gated by USE_<LIB> macros set at the top of lib/curl_setup.h. The lib/curl_config-cmake.h.in and configure.ac-generated lib/curl_config.h are the central inventory.

Because dependencies are optional, the same source tree can build a 200 KB embedded curl with no TLS, a 2 MB Linux distro curl with five protocol families and OpenSSL, and a Windows curl that uses Schannel and SSPI. The configure --help output enumerates every toggle.