curl 8.22 Stops Silently Dropping Large Custom Headers: What Proxy Clients Should Retest

curl 8.22.0, released on 2 September 2026, fixes a request-construction problem described by the curl project as “http: stop dropping large custom headers.” The associated project record says custom request headers larger than the response-header parser limit could be silently omitted or misinterpreted in releases since curl 8.13.0.

The corrected implementation uses delimiter-based parsing for outbound custom fields and token checks. Headers that fit the destination request buffer are transmitted; a request that cannot fit now fails with CURLE_TOO_LARGE. That is an important operational improvement: a clear failure is safer than sending a request whose declared authentication, signing, tracing or application context has silently changed.

Why proxy workflows should care

Proxy-backed collectors and verification workers often add custom headers for an approved destination API, internal correlation, content negotiation or signed requests. A missing field can produce several confusing outcomes:

• the destination rejects the request while the proxy connection remains healthy;
• a signature fails because the wire request differs from the signed request;
• tracing loses the operation identifier needed to join client and gateway evidence;
• an application falls into a generic retry path and rotates exits unnecessarily;
• an upstream returns a default representation that passes a superficial status check.

This does not mean every proxy authentication header was affected or that curl now permits unlimited header sizes. The fix concerns custom outbound HTTP header handling. Each request still has a finite destination buffer and servers, proxies and gateways apply their own limits.

Identify the affected population

Inventory applications using curl or libcurl 8.13.0 through 8.21.0 that send custom HTTP headers. Check embedded SDKs, containers and language bindings rather than assuming the command-line binary represents the running library.

Prioritize workloads with:

• large signed metadata or structured authorization fields;
• long but legitimate trace or policy context;
• dynamically assembled header lists;
• redirects or proxy tunnels where header scope changes;
• success criteria based only on HTTP status;
• automatic retries after origin rejection.

Do not copy real header values into the inventory. Record header name, length range, owner, sensitivity, destination scope and construction path.

Build a controlled regression fixture

Use a test origin and proxy you control. The origin should return the received header name, byte length and a digest calculated over the value, never the sensitive value itself. Prepare synthetic values with no credentials or personal data.

Test at least four sizes:

1. a normal small header;
2. a header below the historical response-parser boundary;
3. a larger header that should fit the outbound request buffer;
4. a deliberately oversized header that cannot fit.

Run the same fixture on the deployed client and curl 8.22.0. For sizes intended to fit, require the origin-reported length and digest to match the client fixture. For the oversized case, require an explicit CURLE_TOO_LARGE failure and verify that no partial request reaches the origin.

Verify the wire request, not configuration

Logging “header added” before transfer proves only that application code built a value. It does not prove the field was emitted. Capture evidence at the authorized test origin or a controlled gateway after TLS termination.

Useful evidence includes:

test_case
client_version
header_name
expected_length
observed_length
expected_digest
observed_digest
curl_result
http_status
redirect_hop
proxy_route_alias

Redact or hash values before storage. Never enable verbose production traces that expose proxy passwords, cookies, tokens or customer data.

Test proxy and origin header scopes separately

An HTTP proxy request and an origin request are not the same boundary. For HTTPS destinations, the client can first issue CONNECT to the proxy, then send the origin request inside the tunnel. Proxy-specific headers belong to the proxy exchange; destination headers belong to the tunneled origin request.

Your test should prove that a custom origin header does not leak into an unrelated proxy exchange and that a proxy-only field is not forwarded to the destination. Include a direct control, an HTTP proxy route and an HTTPS destination through CONNECT.

Use the curl proxy authentication troubleshooting guide when a 407 occurs, and keep proxy authentication evidence separate from origin 401 or 403 responses.

Include redirects and method changes

Redirects can change the destination host and therefore the security scope of a custom header. Test same-origin and cross-origin redirects separately. Define which fields may follow a redirect before the run; sensitive headers should not be forwarded to an unapproved host merely because it is reachable.

Record every hop, effective URL alias and header-presence result. Avoid storing complete URLs when they contain user data or tokens. A final 200 is not sufficient if an intermediate request lost or leaked a field.

Check signing and canonicalization

Signed requests are especially sensitive to silent header changes. The client must sign the same normalized name and value that the origin receives. Test whitespace, empty values, duplicate fields and header-name casing only where the signing specification defines them.

Do not “fix” a failed signature by removing the field from the signed set without a security review. Upgrade the affected client, keep the request within documented limits and fail closed when the emitted request cannot be proven.

Bound failure and retry behavior

CURLE_TOO_LARGE is a deterministic construction failure, not a transient network problem. It should not trigger proxy rotation, rapid retries or direct fallback. Route it to a configuration or payload-size alert.

If a previously silent omission becomes an explicit failure after upgrading, investigate why the header is so large. Prefer a documented body field, server-side reference or smaller claim set when the protocol supports it. Do not split one logical header into arbitrary fields unless the receiving protocol explicitly allows it.

Rollout gates

A safe canary should require:

• exact length and digest for all intended-to-fit fixtures;
• explicit CURLE_TOO_LARGE for the oversized fixture;
• no partial request after a construction failure;
• no origin header leakage into the proxy exchange;
• no proxy-only header forwarded to the origin;
• correct behavior across direct, HTTP proxy and CONNECT routes;
• no sensitive header forwarded across an unapproved redirect;
• bounded retries and no silent direct fallback;
• stable validated-result rate and tail latency.

Roll out to a small worker cohort, then monitor curl result codes, origin rejection classes, signature failures, retry amplification and cost per validated result.

Upgrade checklist

• [ ] Running curl and libcurl versions are inventoried.
• [ ] Custom headers and their maximum expected lengths are mapped.
• [ ] Real values are excluded from test fixtures and logs.
• [ ] Small, boundary, large-valid and oversized cases are covered.
• [ ] The test origin verifies length and digest.
• [ ] Direct, HTTP proxy and CONNECT routes are compared.
• [ ] Redirect scope is tested explicitly.
• [ ] Signed-request canonicalization is verified.
• [ ] Oversized requests fail clearly without being sent.
• [ ] Deterministic failures do not rotate exits or retry.
• [ ] No mandatory-proxy workflow falls back to direct traffic.
• [ ] Rollback and monitoring thresholds are documented.

FAQ

Which curl versions need review?

The curl project record says the silent omission or misinterpretation behavior existed since 8.13.0 and the correction is included in 8.22.0. Verify the actual libcurl loaded by each application.

Does curl 8.22 allow headers of any size?

No. Headers that fit the request buffer can be transmitted, while a request that cannot fit returns CURLE_TOO_LARGE. Other network components can enforce smaller limits.

Is a successful status code enough to prove the fix?

No. The test origin should verify the received length and digest. A server can return 200 after receiving a request with a missing optional header.

Should CURLE_TOO_LARGE be retried through another proxy?

No. It describes local request construction, so changing the exit does not reduce the header. Treat it as a bounded configuration failure.

Related 98IP guidance includes proxy retry amplification control, HAR credential redaction and proxy connection pooling.

Source note: curl project, “Changes in 8.22.0,” released 2 September 2026; curl project record “http: stop dropping large custom headers.” External source locations are retained only in the internal operations record.

Use only controlled test systems and destinations you are authorized to access. Respect endpoint terms, header-size policies, rate limits, privacy obligations and applicable law. Never include live credentials or personal data in a header-size regression fixture.