Bug 2491199 - Consider adding HTTP/3 support to libcurl-minimal
Summary: Consider adding HTTP/3 support to libcurl-minimal
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Fedora
Classification: Fedora
Component: curl
Version: 44
Hardware: All
OS: Linux
unspecified
low
Target Milestone: ---
Assignee: Jan Macku
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-21 16:43 UTC by Alex Haydock
Modified: 2026-07-31 06:41 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2026-07-31 06:41:34 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Alex Haydock 2026-06-21 16:43:41 UTC
Fedora, when installed with libcurl-minimal instead of full libcurl, is not capable of HTTP/3 connectivity in curl and other apps that depend on libcurl.

This is the package that is shipped by default in Fedora Atomic images (see: https://forge.fedoraproject.org/atomic-desktops/tracker/issues/120) and I assume traditional Fedora desktop images too, based on: https://fedoraproject.org/wiki/Changes/CurlMinimal_as_Default

Based on the wording of that change request above, much of the motivation here centres around security and a desire not to ship the attack surface associated with obsolete and rarely-used protocols:

"Those infrequently used protocols are less tested than the common ones and are a source of security bugs. Most users are not using those protocols anyway, so disabling them reduces the bug and attack surface."

I'd argue that this makes sense for protocols like Gopher, LDAP, POP3 etc. But maybe not so much for HTTP/3, which I think an end-user would reasonably expect to be available by default on a distro like Fedora.

Reproducible: Always

Steps to Reproduce:
1.podman run --rm -it quay.io/fedora-ostree-desktops/silverblue:44 curl --version
2.podman run --rm -it quay.io/fedora-ostree-desktops/silverblue:44 curl --http3-only https://google.com

Actual Results:
1. curl output does not show `HTTP3`
2. `curl: option --http3-only: the installed libcurl version does not support this`

Expected Results:
1. curl version output should show `HTTP3` if HTTP/3 is supported
2. This should work

Additional Information:
Note that I am using the Fedora Atomic Silverblue container in my example above because interestingly the regular Fedora container does actually ship full libcurl. But this can be reproduced on any system with libcurl-minimal.

Edit: It's been brought to my attention that the Fedora change proposal to ship `libcurl-minimal` as the default version didn't actually pass, so it's possible that the fact the Atomic Fedora distributions are shipping the minimal package is unintentional. I do think my point here stands though that if `libcurl-minimal` is going to support HTTP, then I think it's reasonable to expect that to include all current versions of HTTP.

Comment 1 Jan Macku 2026-07-31 06:41:07 UTC
We recently added support for HTTP/3 to the curl RPM[1]. I understand your point, but I would like to wait a bit to see how many issues and CVEs it might bring. The original idea behind curl minimal subpackages is still valid. Curl is by default available in every image, so we want as minimal a footprint as possible to avoid excessive amounts of CVEs (especially in an era when everybody is trying to use AI to find new vulnerabilities).

I'll close this issue for now.

[1] - https://src.fedoraproject.org/rpms/curl/pull-request/61


Note You need to log in before you can comment on or make changes to this bug.