How to upgrade of 'curl' package on Debian and Ubuntu systems to fix HTTP/2 bugs

[abraunegg]

Due to longstanding issues with Debian, Ubuntu, and related Ubuntu derivatives (Linux Mint, Pop!_OS etc) shipping outdated, broken, or insecure versions of curl, users are often left exposed to critical bugs or missing features — with no timely resolution provided by their distribution.

The only exception to this is Debian, which offers a supported upgrade path via backports.

To help address this, @Cyber5imon has shared a working script that manually upgrades curl to version v8.11.0. The details below have been updated to the latest 'curl' release:

#!/bin/bash

# Upgrade curl to v8.14.1
sudo apt-get install -y nghttp2 libnghttp2-dev libssl-dev libpsl-dev build-essential wget
wget https://curl.se/download/curl-8.14.1.tar.xz
tar -xvf curl-8.14.1.tar.xz
rm curl-8.14.1.tar.xz
cd curl-8.14.1
./configure --prefix=/usr/local --with-ssl --with-nghttp2 --enable-versioned-symbols
make
sudo make install
sudo ldconfig
cd ..
rm -r curl-8.14.1
curl --version

While outcomes may vary depending on your environment, this approach has been tested and verified by community users on both Debian and Ubuntu.

Important

If you choose to manually build and install curl, you are fully responsible for maintaining it going forward. This includes staying on top of future security updates and rebuilding as needed.

If this maintenance burden is unacceptable, you should:

• Complain loudly to your distribution to provide timely updates to curl, OR
• Switch to a more actively maintained distribution that delivers timely security and feature updates — such as:
  • Linux Mint Debian Edition
  • Arch Linux
  • Manjaro
  • Fedora
  • openSUSE Tumbleweed

Instructions for Debian 12 and Linux Mint Debian Edition 6 (LMDE6)

If you are using Debian 12 or Linux Mint Debian Edition 6 (LMDE6), a supported curl upgrade path is available:

• Ensure your system has Debian 12 Backports enabled:
  • https://backports.debian.org/Instructions/
• Install the latest curl and libcurl packages using:

sudo apt-get install -t bookworm-backports -y curl libcurl4

This is the preferred method on Debian 12 and derivatives, as it avoids the need for manual compilation while still delivering an up-to-date version of curl.

[atomic-5]

Thanks for the script. Fixed the issue on my Mint 22 system.

[rogercreagh]

Thank you. That worked on Ubuntu 24.04.1
Being cautious I copied and ran each line separately in case of problems - but all was good.

[ArtificialTruth]

EDIT: Issue fixed installing by deactivating conda enviroment with

conda deactivate

Then running above script line by line.

---

I'm having issues removing the old version of curl on ubuntu 22.04
Ran above script then tried to remove curl:

$ sudo apt remove curl
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libllvm11 libnsl-dev libphobos2-ldc-shared98 libtirpc-dev
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  curl
0 upgraded, 0 newly installed, 1 to remove and 10 not upgraded.
After this operation, 455 kB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 310138 files and directories currently installed.)
Removing curl (7.81.0-1ubuntu1.19) ...
Processing triggers for man-db (2.10.2-1) ...

$ curl --version
curl 8.5.0 (x86_64-conda-linux-gnu) libcurl/8.5.0 OpenSSL/3.0.13 zlib/1.2.13 libssh2/1.10.0 nghttp2/1.57.0
Release-Date: 2023-12-06
Protocols: dict file ftp ftps gopher gophers http https imap imaps mqtt pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp
Features: alt-svc AsynchDNS GSS-API HSTS HTTP2 HTTPS-proxy IPv6 Kerberos Largefile libz NTLM SPNEGO SSL threadsafe TLS-SRP UnixSockets

However onedrive display config still says:

~$ onedrive/onedrive --display-config 
Curl version                                 = libcurl/7.81.0 OpenSSL/3.0.2 zlib/1.3.1 brotli/1.0.9 zstd/1.4.8 libidn2/2.3.2 libpsl/0.21.0 (+libidn2/2.3.2) libssh/0.9.6/openssl/zlib nghttp2/1.43.0 librtmp/2.3 OpenLDAP/2.5.18

It seems building onedrive from source somehow doesn't use the new curl version.
Perhaps i need to rebuild onedrive from source after installing the new curl version?

[abraunegg]

Please raise your Ubuntu questions with Ubuntu support - I cannot assist with questions or problems with Ubuntu regarding curl/libcurl.

Your alternative option is to stop using Ubuntu and use a better quality distribution such as Debian 12 if you wish to stay with that ecosystem or use a totally different distribution such as Arch, Fedora or similar.

[ArtificialTruth]

Okay, I will assume it is not a problem with Onedrive and instead ubuntu somehow not deleting the old curl.

Thanks for the advice regarding debian.

[rogercreagh]

Since your system seems to be reporting curl version is now 8.5.0 it looks like the install didn't work correctly - it should be 8.11.0

Suggest you run the script again one line at a time and see where it is going wrong. Open the script in a text editor and copy each line in turn and paste it into a terminal and press enter. It may be that you have an alternative repository for curl installed and it is fetching the wrong version.

You could try removing curl before running the lines in the script, and/or clearing the Curl version = line in the onedrive config file. Also check at the top of the onedrive --display-config listing that it is fetching the correct version of onedrive - have you updated to 2.5.3 or is it still running an older version - the script only updates curl, not onedrive.

[ArtificialTruth]

Thank you, I resolved the issue, see above edit.

[the-snaveson]

Thankyou @abraunegg . Your onedrive client is an absolute winner and this curl fix script was pitched perfectly for my level of Linux (in)competence.

[CodeKlopfer]

Thanks, works on my Ubuntu 22.04.5 LTS with freshly released curl-8.11.1.tar.xz

[randellhodges]

I have a similar with with Debian 12 (in a proxmox LXC container)

I installed curl from backports
apt install curl/bookworm-backports

I uninstalled and then reinstalled onedrive with apt (do I need to build onedrive from src to get it to see/use curl 8.11.1?)

curl version

root@fileServer:~# curl --version
curl 8.11.1 (x86_64-pc-linux-gnu) libcurl/8.11.1 GnuTLS/3.7.9 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 libssh2/1.10.0 nghttp2/1.52.0 ngtcp2/1.9.1 nghttp3/1.6.0 librtmp/2.3 OpenLDAP/2.5.13
Release-Date: 2024-12-11, security patched: 8.11.1-1~bpo12+1
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt pop3 pop3s rtmp rtsp scp sftp smb smbs smtp smtps telnet tftp ws wss
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz NTLM PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

onedrive version (used the OpenSuSE install instructions)

root@fileServer:~# onedrive --display-config

WARNING: Your cURL/libcurl version (7.88.1) has known HTTP/2 bugs that impact the use of this client.
         Please report this to your distribution, requesting an update to a newer cURL version, or consider upgrading it yourself for optimal stability.
         Downgrading all client operations to use HTTP/1.1 to ensure maximum operational stability.
         Please read https://github.com/abraunegg/onedrive/blob/master/docs/usage.md#compatibility-with-curl for more information.

Application version                          = onedrive v2.5.3-1+np1+1.1
Compiled with                                = LDC 2100
Curl version                                 = libcurl/7.88.1 OpenSSL/3.0.15 zlib/1.2.13 brotli/1.0.9 zstd/1.5.4 libidn2/2.3.3 libpsl/0.21.2 (+libidn2/2.3.3) libssh2/1.10.0 nghttp2/1.52.0 librtmp/2.3 OpenLDAP/2.5.13

[abraunegg]

@randellhodges

I uninstalled and then reinstalled onedrive with apt (do I need to build onedrive from src to get it to see/use curl 8.11.1?)

It looks like you upgraded 'curl' but did not upgrade 'libcurl' on your Debian 12 platform. The client uses 'libcurl' which generally should always be updated when you update 'curl' itself, but it looks like Debian 12 changed that dependency linkage. To correctly update, use the following example:

apt-get install -t bookworm-backports -y curl libcurl4

I would raise a bug with Debian as you should not be able to upgrade 'curl' without upgrading 'libcurl' as well.

[randellhodges]

That indeed fixed it for me. Thank you.

[denniswed]

Thanks for the information here. One thing I had to do was remove existing curl using
sudo apt remove curl

then I had to manually
sudo rm /usr/loca/bin/curl
sudo rm /usr/local/bin/curl-config

then run all the steps above.

Hopefully this is helpful for others.

[bmayfi3ld]

Thanks for this!

Wanted to add that my install did not have the right zlib packages for curl to install with compression. So I was getting errors like.

curl: option --compressed: the installed libcurl version doesn't support this

when using curl with other tools (for me specifically it was brew)

I just had to install zlib with

sudo apt-get install zlib1g-dev

then ran the script

[perezjasonr]

Thanks for this!

Wanted to add that my install did not have the right zlib packages for curl to install with compression. So I was getting errors like.

curl: option --compressed: the installed libcurl version doesn't support this

when using curl with other tools (for me specifically it was brew)

I just had to install zlib with

sudo apt-get install zlib1g-dev

then ran the script

you are a lifesaver, i was getting that same error and when i kept trying to research this all i could find was nonsense about cygwin and running curl on windows. Your random comment was the only one that seems to have fixed it. Where did you find out about that zlib1g-dev package?

[samueloph]

Hello, I'm one of the curl maintainers on Debian,

I'm happy to see that the package provided in bookworm-backports allowed users to workaround the problem.

However, the recommendation for users to compile their own curl package needs to be approached carefully: when an user does this, that custom-installed curl package will not avail of any of the security fixes or bugfixes that we release for the official curl package.

If you are aware of a specific problem with the version shipped in Debian 11/12, please file a bug report and/or point to one already filled. If the problem can be fixed with a patch, we can backport that into Debian 11/12.

[samueloph]

However, the recommendation for users to compile their own curl package needs to be approached carefully: when an user does this, that custom-installed curl package will not avail of any of the security fixes or bugfixes that we release for the official curl package.

This is why the script above builds (needs to be updated) the latest release of 'curl' so that all the correct fixes are being pulled in.

This doesn't address the issue unfortunately, the problem is not that the user needs to install the latest version, the problem is that once they install that, they don't update it, and neither receive the updates from the official package, since that's a custom one.

[abraunegg]

This doesn't address the issue unfortunately, the problem is not that the user needs to install the latest version, the problem is that once they install that, they don't update it, and neither receive the updates from the official package, since that's a custom one.

100% agree with this point .. however if distributions provided up-to-date versions for users to consume this would be less of an issue.

IMHO, when you look at Ubuntu (https://launchpad.net/ubuntu/+source/curl):

Only 'security' patches are backported ... all of the bug fixes never are. What should happen IMHO is that the latest curl version should be provided as an 'update' to the existing package ...

Because so many folk use Ubuntu .. its package position actually puts users in a worse usability position as the software that is supposed to be supported long term, actually contain bugs that impact productivity and usability of their distribution ....

The above 'curl' example is just one of significant volume of broken packages on Ubuntu where bugs that have been fixed are never rolled into that distribution - and only on a 'new LTS' is some arbitrary version chosen instead of looking deeper and asking is that the right version to use.

[samueloph]

Only 'security' patches are backported ... all of the bug fixes never are.

Bugfixes can be backported too, that's why I was asking for more details on the issue.

What should happen IMHO is that the latest curl version should be provided as an 'update' to the existing package ...

This is already an option to users, they can always upgrade to the newer release, the reason they don't do that is the same reason we can't just bump curl on a stable release: stability.

Bumping curl will fix some issues but it will bring new ones, users get to chose when they want to accept this risk by updating to the new major release of a given distro (which will contain a more recent release of curl).

This is not something specific to Ubuntu or Debian, every non-rolling release distribution works this way. And for those that want a rolling Debian release, there's always Debian Testing.

[abraunegg]

@samueloph

Bugfixes can be backported too, that's why I was asking for more details on the issue.

Please review: https://github.com/abraunegg/onedrive/blob/master/docs/usage.md#compatibility-with-curl

This details all of the 'curl' bugs that I have been able to identify that impact the operational stability of 'onedrive' on those specific distributions and versions. Those would be the bugs I would target for any back-porting, but there might be others as well. The complexity of backporting may also mean it is too hard to actually do - which, you get to the point of - a new version release is needed for those impacted distributions.

Further research as to the operational impact of these bugs can be done with these links:

• https://github.com/abraunegg/onedrive/issues?q=is%3Aissue%20state%3Aclosed%20label%3A%22Curl%20Compatibility%22
• https://github.com/abraunegg/onedrive/wiki/Debugging-SSL-TLS-Issues-when-the-client-stops-syncing-with-no-crash

Where an issue has a correlation to a known curl issue, it has been flagged with the 'curl compatibility' label - I am sure that there will be others, but that will give you an idea as to the impact of these older versions of 'curl' in supposed stable distributions.

Bugs that impact operation stability make a distribution less stable (essentially making it unstable for the task being performed) ... it is a fallacy and grievous misdirect to represent any other position.

[CoSoCo]

IMHO, when you look at Ubuntu (https://launchpad.net/ubuntu/+source/curl):

So when comparing with https://github.com/abraunegg/onedrive/blob/master/docs/usage.md#known-curl-versions-with-compatibility-issues-for-this-client, Ubuntu 25.04 is the only distro with no compatibility issues, as it provides cURL verstion 8.12.1.
Right?

[CoSoCo]

As I already installed the OneDrive package from the OpenSUSE repository according https://github.com/abraunegg/onedrive/blob/master/docs/ubuntu-package-install.md#distribution-ubuntu-2404, wouldn't it be possible, to also get the latest cURL version from there? (At least a newer one, than from Ubuntu 24.04.)
(anyway, the above install guide uses /usr/share/keyrings/ to store the key, but /etc/apt/keyrings/ should be used according https://wiki.debian.org/DebianRepository/UseThirdParty
"If it will be managed locally , it SHOULD be downloaded into /etc/apt/keyrings instead." )

The installation I'm currently doing is for another person, where I'm not able to manually upgrade cURL in the future by manual compiling.

Could it be another solution to add the Debian backport repository with appropriate apt pinning, to get the latest updates from there?

[CoSoCo]

Just for fun, I installed the current Debian packages manually on Ubuntu 24.04 to hopefully get around the update problem.

sudo apt install ./libldap-2.5-0_2.5.13+dfsg-5_amd64.deb ./ libcurl4_8.14.1-2~bpo12+1_amd64.deb ./curl_8.14.1-2~bpo12+1_amd64.deb

Unfortunately, OneDrive still finds cURL version 8.5.0.

[abraunegg]

Unfortunately, OneDrive still finds cURL version 8.5.0.

Whilst you can install Debian packages on that version of Ubuntu - the libraries / binaries will be going somewhere else .. which is why 'onedrive' sees the default Ubuntu versions.

This situation you are in is due to your choice of using Ubuntu. There are better distributions to use than Ubuntu. If you wish to stay within the apt ecosystem for knowledge/familiarity reasons, use:

• Debian 12
• Linux Mint Debian Edition 6

If you wish to continue to use Ubuntu, this is your choice - but please complain to Ubuntu about their lack of keeping packages up-to-date and/or providing packages via a 'backports' capability.

[rogercreagh]

Uninstall Curl and run the script in the original post at the top from a command prompt one line at a time. Worked fine for me on Ubuntu 24.04

[CoSoCo]

Uninstall Curl

Why? It would remove all apps, which are dependent from curl, including onedrive:

$ LC_ALL=C apt -s remove curl libcurl4t64
[.....]
The following packages will be REMOVED:
  colord curl djvulibre-bin fcitx5-module-cloudpinyin gscan2pdf gvfs-backends
  hplip libcurl4t64 libgphoto2-6t64 libimage-sane-perl libreoffice-base-core
  libreoffice-calc libreoffice-core libreoffice-draw libreoffice-gnome
  libreoffice-gtk3 libreoffice-impress libreoffice-math libreoffice-writer
  libsane1 libtesseract5 libwxbase3.2-1t64 libwxgtk3.2-1t64 onedrive pdf2djvu
  python3-uno remmina remmina-plugin-rdp remmina-plugin-secret
  remmina-plugin-vnc sane-utils shotwell simple-scan tesseract-ocr
  transmission-gtk wine-stable wine-stable-amd64 winehq-stable winetricks
  wxhexeditor xsane
0 upgraded, 0 newly installed, 41 to remove and 6 not upgraded.

and run the script in the original post at the top from a command prompt one line at a time. Worked fine for me on Ubuntu 24.04

This is, what I've already done. For the moment, it works fine. But when onedrive becomes updated from the OpenSUSE repository, it could be incompatible again. The machine I'm configuring, is for a doctor. He will not be able to deal with this script.
That's why I suggested #3400

[abraunegg]

@CoSoCo

That's why I suggested #3400

While I understand the frustration caused by outdated curl/libcurl packages in upstream distributions like Ubuntu, I respectfully rejected the request to maintain or distribute custom curl binaries alongside the onedrive client. Here's why:

Scope of Responsibility

As the developer and maintainer of the OneDrive Client for Linux, my role is to ensure this project operates correctly with standard system-provided dependencies. Maintaining a fork or custom version of curl would fall well outside the boundaries of what I develop, test, and support. I have no development oversight, governance, or involvement in the curl project or its security lifecycle, which means I cannot guarantee compatibility, stability, or security of any version I might attempt to redistribute.

Security and Trust

Distributing a custom-built curl package introduces a significant trust and security risk. Users would be relying on a third party (in this case, me) to compile, patch, test, and maintain a security-critical piece of infrastructure—one that handles TLS/SSL, certificate verification, and HTTP/2 protocols. This should always be handled by the distribution's package maintainers, who are responsible for security patches, ABI compatibility, and system-wide integration testing.

System Integration Risks

curl and libcurl are core components used by a wide array of system packages and applications. Providing a custom version risks:

• ABI and compatibility mismatches
• Broken packages or subtle runtime bugs
• Interference with automated system updates or security patching

These risks are simply not acceptable for production systems, especially for users who may not have the technical expertise to resolve such breakage—exactly the type of user you're trying to protect in this case.

Best Practices and Upstream Pressure

The correct long-term solution is for distributions to ship appropriately up-to-date versions of widely used libraries like curl. If upstream packaging is lagging behind or is unsuitable for modern application needs, pressure should be applied to the distribution maintainers (e.g., filing bugs, participating in mailing lists, or advocating via official channels). In some cases, enabling a backports or security repository may be sufficient.

For more immediate needs, deploying via containerised environments (Docker, Podman) or using AppImages or Flatpaks can offer a way to bundle newer libraries without compromising the host system.

The machine I'm configuring, is for a doctor. He will not be able to deal with this script.

Specifically for your issue .. as suggested before - use a better distribution such as Debian 12 or Linux Mint Debian Edition 6 where you can install the updated curl/libcurl version from 'backports. But you do not wish to do this - fine .... please go complain to Ubuntu and raise a bug here: https://bugs.launchpad.net/ubuntu/+source/curl and get Ubuntu to ship a newer version.

Or bite the bullet and use a better distribution!

[CoSoCo]

While I understand the frustration caused by outdated curl/libcurl packages in upstream distributions like Ubuntu, I respectfully rejected the request to maintain or distribute custom curl binaries alongside the onedrive client. Here's why:
[.....]

I fully respect your decision. Much thanks for your detailed reasoning.

System Integration Risks

[.....]
These risks are simply not acceptable for production systems, especially for users who may not have the technical expertise to resolve such breakage—exactly the type of user you're trying to protect in this case.

Yes, but using the script above causes the same problems.

So for now, I take the risk, because of the unique advantages of the Unity desktop, which is only available with Ubuntu.
It was designed to make more efficient use of space given the limited screen size of netbooks, including, for example, a vertical application switcher called the launcher, and a space-saving horizontal multi-purpose top menu bar.

For more immediate needs, deploying via containerised environments (Docker, Podman) or using AppImages or Flatpaks can offer a way to bundle newer libraries without compromising the host system.

To my knowledge, there is no such container for OneDrive.

.... please go complain to Ubuntu and raise a bug here: https://bugs.launchpad.net/ubuntu/+source/curl and get Ubuntu to ship a newer version.

Done: https://bugs.launchpad.net/ubuntu/+source/curl/+bug/940431/comments/9

[DanielGarnero]

Español (mi lengua materna)
Muchas gracias!! No usé el script, sino que corrí línea tras línea, para verificar el proceso, y funcionó muy bien! Incluso, he apuntado a una versión más nueva (8.15.0) y se instaló sin problemas.
Gracias otra vez!

English (ChatGPT translation ;) )
Thank you very much!! I didn’t use the script, but instead ran it line by line to check the process, and it worked really well! I even pointed to a newer version (8.15.0) and it installed without any issues.
Thanks again!

[Xalalau]

Ty. Here is the script with some small changes:

#!/bin/bash

version="8.16.0"

# Upgrade curl to v$version
sudo apt-get install -y nghttp2 libnghttp2-dev libssl-dev libpsl-dev build-essential wget
wget https://curl.se/download/curl-$version.tar.xz
tar -xvf curl-$version.tar.xz
rm curl-$version.tar.xz
cd curl-$version
./configure --prefix=/usr/local --with-ssl --with-nghttp2 --enable-versioned-symbols
make -j$(($(nproc) - 1))
sudo make install
sudo cp /usr/local/bin/curl /usr/bin/curl
sudo ldconfig
cd ..
rm -r curl-$version
sudo apt hold curl libcurl*
curl --version

• easier to set the version, newer version
• "make" uses almost all threads
• copy the curl executable to /usr/bin (I'm not sure it's needed, but I prefer this way)
• hold packages to make sure they won't update

Note: HTTP1.1 and IPV4 can be configured in the program. I'm using OneDriveGui to set them up:

[CoSoCo]

1. Currently I use curl version 8.14.1 on Ubuntu 24.04.
   Is it better to update to 8.16, or better to not touch the running system?

2. Is the alternative script of @Xalalau officially recommended.

[abraunegg]

Please stick with v8.14.1 as this is what I have tested.

I have not tested any version greater than this. I also do not use Ubuntu.

[Xalalau]

I've been using 8.16.0 all this time without issues, just so you know. Ty.

[anfemosa]

I just update curl to 8.18.0 version without issues. Ty.

[abraunegg]

Thanks for the feedback