Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PC×
FREEDOM251

Freedom251 › Blog › curl

curl HTTP/2 vs. HTTP/1.1 for File Uploads: Security, Compatibility, and Performance

By Freedom251 Team · · 10 min read

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use the upload format the endpoint requires, then let HTTPS negotiate HTTP/2 when it works. Choose --upload-file for a direct PUT endpoint and --form for a multipart/form-data endpoint. HTTP/2 can improve concurrency and connection reuse, but there is no universal speed advantage for one large file. Keep --http1.1 as a documented fallback when a proxy, gateway, or origin has HTTP/2 problems.

What the choice actually involves

There are two separate decisions in a curl upload:

  • Body contract: how the server expects the file and metadata to be encoded.
  • HTTP version: how that request is framed and transported over the connection.

HTTP/2 does not turn a PUT body into a form upload, and HTTP/1.1 does not require a particular file representation. RFC 7540 keeps HTTP semantics while changing framing and connection behavior. The same PUT or multipart request can be carried over either HTTP/1.1 or HTTP/2 if the server and client support it.

As an Amazon Associate I earn from qualifying purchases.

Question Use this decision
What body does the endpoint accept? PUT with --upload-file, or multipart form with --form, according to the API contract.
Which protocol should carry it? Try HTTPS with normal HTTP/2 negotiation when the curl build advertises HTTP/2.
What if an intermediary fails? Force HTTP/1.1 with --http1.1 and record the reason.
Is HTTP/2 always faster? No. Measure the real endpoint, file sizes, concurrency, latency, and proxy path.

HTTP/2 and HTTP/1.1: the relevant differences

HTTP/1.1 behavior

HTTP/1.1 sends each request as a textual message on a connection. Parallel work commonly requires several connections, and a slow response can delay later work on the same connection. Headers are repeated for each request. These characteristics matter most when an application makes many requests or uploads several objects at once.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

HTTP/2 behavior

HTTP/2 uses binary framing and multiplexed streams. Multiple requests and responses can share one connection, headers can be compressed with HPACK, and stream prioritization is available. This addresses HTTP/1.1’s connection and head-of-line limitations at the HTTP layer. It does not remove congestion, packet loss, server processing time, disk limits, or application-level flow control.

#1 Best Overall
Sale
TP-Link USB to Ethernet Adapter,Support Nintendo Switch,1Gbps,Plug and Play | Gigabit RJ45 to USB A 3.0 Network Adapter, Foldable & Portable Design, Compatible w/ Windows, macOS, & Linux(UE306)
  • 𝐇𝐢𝐠𝐡-𝐒𝐩𝐞𝐞𝐝 𝐔𝐒𝐁 𝐄𝐭𝐡𝐞𝐫𝐧𝐞𝐭 𝐀𝐝𝐚𝐩𝐭𝐞𝐫 - UE306 is a USB 3.0 Type-A to RJ45 Ethernet adapter that adds a reliable wired network port to your laptop, tablet, or Ultrabook. It delivers fast and stable 10/100/1000 Mbps wired connections to your computer or tablet via a router or network switch, making it ideal for file transfers, HD video streaming, online gaming, and video conferencing.
  • 𝐔𝐒𝐁 𝟑.𝟎 𝐟𝐨𝐫 𝐅𝐚𝐬𝐭𝐞𝐫, 𝐌𝐨𝐫𝐞 𝐒𝐭𝐚𝐛𝐥𝐞 𝐃𝐚𝐭𝐚 𝐓𝐫𝐚𝐧𝐬𝐟𝐞𝐫𝐬- Powered via USB 3.0, this adapter provides high-speed Gigabit Ethernet without the need for external power(10/100/1000Mbps). Backward compatible with USB 2.0/1.1, it ensures reliable performance across a wide range of devices.
  • 𝐒𝐮𝐩𝐩𝐨𝐫𝐭𝐬 𝐍𝐢𝐧𝐭𝐞𝐧𝐝𝐨 𝐒𝐰𝐢𝐭𝐜𝐡- Easily connect your Nintendo Switch to a wired network for faster downloads and a more stable online gaming experience compared to Wi-Fi.
  • 𝐏𝐥𝐮𝐠 𝐚𝐧𝐝 𝐏𝐥𝐚𝐲- No driver required for Nintendo Switch, Windows 11/10/8.1/8, and Linux. Simply connect and enjoy instant wired internet access without complicated setup.
  • 𝐁𝐫𝐨𝐚𝐝 𝐃𝐞𝐯𝐢𝐜𝐞 𝐂𝐨𝐦𝐩𝐚𝐭𝐢𝐛𝐢𝐥𝐢𝐭𝐲- Supports Nintendo Switch, PCs, laptops, Ultrabooks, tablets, and other USB-powered web devices; works with network equipment including modems, routers, and switches.
Characteristic HTTP/1.1 HTTP/2 Upload implication
Framing Text-based messages Binary frames Different wire format; the request semantics remain the same.
Concurrency Often multiple connections Multiplexed streams on a connection More useful for concurrent uploads or mixed API traffic.
Headers Repeated, uncompressed in the protocol HPACK compression Can reduce overhead, usually a small part of a large file transfer.
Negotiation Default fallback for many deployments Selected by TLS ALPN for HTTPS or Upgrade/prior knowledge for cleartext Actual use depends on both peers and intermediaries.
Single large body One request body on one connection One stream carrying the body Throughput is usually governed by network, flow control, and receiver capacity.

First identify the server’s upload contract

Direct PUT with --upload-file

Use this form when the API documents a file as the request body of a PUT request:

curl --upload-file ./archive.zip https://example.example/upload

For HTTP and HTTPS URLs, curl uses PUT. If the URL does not specify a remote filename, curl appends the local filename; the manual’s trailing-slash rules determine how that URL is formed. The server still decides whether the name is accepted, whether an existing object is overwritten, what authorization is required, and which content type is valid.

A direct PUT is not an HTML-style form submission. Do not add --form simply because the payload is a file. If the API needs metadata, check whether it defines headers, query parameters, or a separate JSON operation; inventing fields can make an otherwise valid upload fail.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Multipart form with --form

Use multipart when the endpoint expects multipart/form-data:

curl --form 'file=@./archive.zip' https://example.example/upload

The file part is a form field whose value comes from the local file. Add additional parts only when the API documents their names and formats:

curl --form 'file=@./archive.zip' 
     --form 'description=nightly backup' 
     https://example.example/upload

--form is mutually exclusive with --upload-file and --data. They select different body encodings; combining them does not create a more complete upload.

Literal untrusted form values

When a field value comes from a user or another untrusted source and must remain literal, use --form-string:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Amazon Basics USB 3.0 to 10/100/1000 Gigabit Ethernet Internet Adapter, Compatible with Windows and macOS, Black
  • Connects a USB 3.0 device (computer/laptop) to a router, modem, or network switch to deliver Gigabit Ethernet to your network connection. Does not support Smart TV or gaming consoles (e.g.Nintendo Switch).
  • Supported features include Wake-on-LAN function, Green Ethernet & IEEE 802.3az-2010 (Energy Efficient Ethernet)
  • Supports IPv4/IPv6 pack Checksum Offload Engine (COE) to reduce Cental Processing Unit (CPU) loading
  • Compatible with Windows 8.1 or higher, Mac OS
curl --form 'file=@./archive.zip' 
     --form-string 'description=@not-a-filename' 
     https://example.example/upload

The form parser gives special meaning to leading characters such as @ and <. With ordinary --form, an untrusted value can therefore be interpreted as a local filename or file input. Validate filenames and metadata before constructing a command as well.

How curl selects HTTP/2 or HTTP/1.1

HTTPS: normal negotiation

For an HTTPS URL, this command asks libcurl to negotiate HTTP/2 during the TLS handshake:

curl --http2 --upload-file ./archive.zip https://example.example/upload

The option is a request, not an unconditional mandate. The curl executable must be linked to a libcurl build with HTTP/2 support, and the server and any intermediary must agree to use it. If negotiation does not select HTTP/2, the request can proceed with HTTP/1.1.

Check the local feature set first:

curl --version

Look for HTTP2 in the features list. A binary without that feature cannot use the option, regardless of what the server supports.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Forcing HTTP/1.1

Use this when a proxy, load balancer, gateway, or origin is known to have an HTTP/2 interoperability problem:

curl --http1.1 --upload-file ./archive.zip https://example.example/upload

Forcing HTTP/1.1 is a compatibility choice, not a security bypass. Keep certificate verification enabled and document why the fallback is needed so it can be retested after infrastructure changes.

Cleartext HTTP and h2c

With an http:// URL, --http2 attempts an HTTP/1.1 Upgrade exchange. --http2-prior-knowledge skips that exchange and starts with HTTP/2 framing, but it should be used only when the server is documented or otherwise known to accept direct cleartext h2. It is not a generic way to make an unknown server faster.

Rank #3
BENFEI USB 3.0 to Ethernet Adapter, USB C to RJ45 Gigabit LAN (1000Mbps) Network Adapter, Compatible with MacBook/Pro/Air, Surface Pro, Windows 11/10/8/7, Mac OS [Aluminium Shell&Nylon Cable]
  • COMPACT DESIGN - The compact-designed portable BENFEI USB A/C to Ethernet adapter connects your computer or tablet to a router,modem or network switch for network connection. It adds a standard RJ45 port to your Ultrabook, notebook or Macbook Air for file transferring, video conferencing, gaming, and HD video streaming.
  • SUPERIOR STABILITY - Built-in advanced IC chip works as the bridge between RJ45 Ethernet cable and your USB A/C devices. The driver-free installation with native driver support in Chrome, Mac, and Windows OS; The USB A/C Ethernet adapter dongle supports important performance features including Wake-on-Lan (WoL), Full-Duplex (FDX) and Half-Duplex (HDX) Ethernet, Crossover Detection, Backpressure Routing, Auto-Correction (Auto MDIX).
  • INCREDIBLE PERFORMANCE - Supports full 10/100/1000Mbps gigabit ethernet performance over USB A/C's 5Gbps bus, faster and more reliable than most wireless connections. Link and Activity LEDs. USB powered, no external power required. Backward compatible with USB 2.0/1.1.✅ To reach 1Gbps, make sure to use CAT6 & up Ethernet cables.
  • BROAD COMPATIBILITY - The USB A/C-Ethernet adapter is compatible with Windows 11/10/8.1/8/7/Vista/XP, Mac OSX 10.6/10.7/10.8/10.9/10.10/10.11/10.12, Linux kernel 3.x/2.6, Android and Chrome OS.Compatible with IEEE 802.3, IEEE 802.3u and IEEE 802.3ab. Supports IEEE 802.3az (Energy Efficient Ethernet).❌Do Not Support Windows RT. (NOT compatible with Nintendo Switch.)
  • 18 MONTH WARRANTY - Exclusive BENFEI Unconditional 18-month Warranty ensures long-time satisfaction of your purchase; Friendly and easy-to-reach customer service to solve your problems timely.

Production file uploads should normally use HTTPS. Cleartext h2c has weaker protection against cross-protocol attacks and provides no confidentiality for the file or credentials.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How to verify what was actually negotiated

Do not infer the protocol from the command line option alone. Capture verbose output for a diagnostic run:

curl --http2 -v --upload-file ./archive.zip https://example.example/upload

The connection and response lines show whether HTTP/2 was selected and expose TLS, proxy, redirect, and status information. A trace can provide lower-level detail when a gateway resets a stream or changes behavior:

curl --http2 --trace-time --trace-ascii ./curl.trace 
     --upload-file ./archive.zip https://example.example/upload

Remove traces after troubleshooting if they contain authorization headers, filenames, metadata, or other sensitive information. Compare the negotiated protocol, response status, and timing under the same URL and request body when testing HTTP/2 against HTTP/1.1.

Security: protocol version is only one layer

Use HTTPS and certificate verification

HTTP/2 over HTTPS uses TLS application-layer protocol negotiation (ALPN). RFC 7540 describes ALPN as a positive indication that the peer is willing to proceed with HTTP/2, which helps prevent cross-protocol attacks. HTTPS also protects the file in transit and authenticates the server when certificate verification succeeds.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Do not add --insecure to hide a negotiation or certificate problem. Fix the trust store, hostname, proxy interception policy, or server certificate instead. If policy requires TLS 1.2 or newer, set that minimum explicitly, for example:

curl --http2 --tlsv1.2 --upload-file ./archive.zip https://example.example/upload

The --http2 option by itself does not require TLS 1.2 or a later version; the server and curl’s TLS library determine the negotiated version unless you set a minimum.

Rank #4
Sale
Anker USB C to Ethernet Adapter, Portable 1 Gbps Network Hub | Aluminum, Compact, 10/100/1000Mbps, for MacBook Pro, iPad Pro, ChromeBook, XPS, Galaxy and More
  • The Anker Advantage: Join the 65 million+ powered by our leading technology.
  • Instant Internet: Connect to the internet instantly from virtually any USB-C 3.0 device, and enjoy stable connection speeds of up to 1 Gbps.
  • Lightweight and Compact: The space-saving and portable design measures just over half an inch thick and weighs about the same as a AA battery.
  • Premium Build: Features a sleek aluminum exterior and braided-nylon cable to complement the design of high-end devices.
  • What You Get: PowerExpand USB-C to Gigabit Ethernet Adapter, welcome guide, 18-month worry-free warranty, and friendly customer service.

Protect form parsing and metadata

  • Use --form-string for literal values supplied by users or external systems.
  • Allow only expected metadata fields and lengths.
  • Validate local paths before passing them to a shell command.
  • Keep credentials out of command histories where possible and restrict trace-file access.

Keep curl and libcurl patched

The curl project’s CVE index lists CVE-2026-92392, “HTTP/2 upload Use-After-Free,” published on 2026-10-14, with affected versions shown as 8.12.0 through 8.22.0. Because this is a time-sensitive advisory, verify the current entry and fixed release before deploying or publishing a version requirement. Upgrade both the command-line client and any application that embeds libcurl, then rerun the upload tests.

Is HTTP/2 faster for a large file?

There is no authoritative, universal percentage for curl HTTP/2 versus HTTP/1.1 file-upload speed. HTTP/2’s multiplexing and header compression can reduce connection and request overhead, but a single large body is commonly limited by other factors:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • available bandwidth and congestion-control behavior;
  • latency, packet loss, and receive-window settings;
  • HTTP/2 stream and connection flow-control windows;
  • disk read speed on the sender and write speed on the receiver;
  • TLS processing and proxy or load-balancer handling;
  • application validation, virus scanning, storage, and response generation.

For one continuously streamed file, the headers are sent once and are tiny compared with the body. HTTP/2 may still perform better on a high-latency path or when the same connection carries other requests, but it may measure the same, or occasionally worse, if an intermediary has an inefficient implementation.

Where HTTP/2 is most likely to help

  • Several uploads or API calls share one connection.
  • The client has many small objects and repeated headers.
  • Connection setup and round trips are expensive.
  • The service supports reliable stream multiplexing through the complete proxy path.

Where the difference may be negligible

  • One very large file already saturates the available uplink.
  • The receiver’s storage or application processing is the bottleneck.
  • A proxy terminates HTTP/2 and forwards HTTP/1.1 to the origin.
  • The upload is short enough that handshake and setup dominate both tests.

How to benchmark your own endpoint

Use representative files and repeatable conditions rather than quoting a protocol-wide speed claim.

  1. Record the URL, authentication method, endpoint contract, file size, and expected success status.
  2. Run a baseline with HTTP/1.1 and save verbose output separately from the payload.
  3. Run the identical request with --http2. Confirm the negotiated protocol rather than assuming it was used.
  4. Repeat each case several times on the same network, then repeat at the latency, bandwidth, and concurrency levels your users experience.
  5. Record elapsed time, average transfer rate, time to first response, status code, retries, and any proxy or gateway errors.
  6. Test one large file and a concurrent workload. HTTP/2’s benefits, if present, may appear in the second test rather than the first.

Keep the body format, destination, authentication, compression settings, and server-side processing identical. A PUT-to-one-server comparison against multipart-to-another server measures endpoint differences, not HTTP versions.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Compatibility troubleshooting

The curl build rejects --http2

Run curl --version. If HTTP2 is absent from the features list, install a build with HTTP/2 support or use the platform’s supported package. Do not attempt to solve a missing client feature by changing server settings.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The server returns an upgrade, protocol, or stream error

  • Repeat with --http1.1 to isolate an HTTP/2 interoperability issue.
  • Capture -v output and identify whether the failure occurs during TLS ALPN, proxy negotiation, request upload, or response handling.
  • Test the same URL through and around the suspected proxy or load balancer if your network policy permits.
  • Give the gateway and origin operators the timestamp, request ID, negotiated protocol, and status code; avoid sending file contents or secrets in a trace.

The request reaches the server but the body is rejected

Check the endpoint contract before changing the protocol. A server expecting multipart will reject a direct PUT body, while a PUT endpoint may reject the multipart boundaries and field names generated by --form. Confirm the required field name, content type, authentication, destination naming, overwrite rule, and maximum size.

Best Value
Sale
Acer USB to Ethernet Adapter, USBC Hub Ethernet 1Gbps with 3*USB 3.0
  • Dual USB-A/C Port Design: This USB hub with ethernet adapter features dual connectors for both USB C and USB A devices, ensuring wide compatibility across laptops, tablets, and smartphones. It includes 1x Gigabit Ethernet port and 3x USB A 3.0 ports, all usable at the same time for smooth and efficient connectivity. 📌Note: When using USB-A to connect devices, please ensure the USB-C is securely attached to the USB-A connector.
  • Stable Gigabit Ethernet Adapter: Get fast, wired Internet up to 1000Mbps with this USB C to ethernet adapter. Backward compatible with 10/100Mbps networks for flexible connectivity across various setups. Ideal for streaming, gaming, and large file transfers. 📌Note: Ensure the RJ45 connector is plugged in securely in the port and use CAT6 & above Ethernet cable is required to reach 1 Gbps.
  • 5Gbps Data Transfer: Transfer large files, photos, and videos in seconds with this USB 3.0 hub supporting speeds up to 5Gbps—10× faster than USB 2.0. Backward compatible with USB 2.0 and 1.1 devices, this USB splitter expands one port into three for connecting keyboards, mice, and flash drives for everyday use. 📌Note: The three USB-A 3.0 ports share a total 5Gbps bandwidth.【NO HDMI port, NO USB-C data port, and NO PD charging】
  • Plug and Play: Reliable USB to ethernet adapter ready to use in seconds. Instantly connects with USB-A and USB-C devices including MacBook Pro/Air, iPad Pro, iMac, Surface Laptops, Chromebook, XPS, tablets, Steam, and smartphones. Works with Windows, macOS, Linux, Chrome OS, and Android. 📌XP/Win7 may need driver. Older systems may not recognize this product due to its USB 3.0 chip. Please refer to the “Installation Manual” to manually download and install the driver.
  • Durable & Portable Build: Made with sturdy aluminum alloy, this RJ45 to USB-C adapter delivers long-term durability, efficient heat dissipation, and stable performance for offices, corporate deployments, classrooms, and campus workstations—while its slim, portable form factor makes it ideal for business travel, educators, and mobile professionals.

The upload succeeds but the wrong filename or metadata appears

For PUT, inspect the URL’s final path and trailing slash; curl may append the local filename when no remote name is supplied. For multipart, check the part name and filename expected by the API. Use --form-string for literal metadata so a leading @ or < cannot be treated as file syntax.

A redirect changes the result

Inspect verbose output for the redirect target. Confirm that the destination accepts the same method and body, that authorization is allowed on the new host, and that your API intentionally permits redirects for uploads. Do not follow redirects blindly across trust boundaries.

Reliability, retries, and operational controls

An HTTP/2 stream reset and an HTTP/1.1 connection close can both leave the server’s final storage state uncertain. Before adding automatic retries, determine whether the endpoint is idempotent, whether it supports an upload identifier, and how it handles duplicate object names. A retry of a PUT may overwrite an object; a retry of a multipart request may create a second record.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Set connection and total-operation time limits appropriate to the file size, log the response status and server request ID, and retain enough context to distinguish a client failure from a server-side validation error. If the service offers resumable uploads, follow its documented protocol rather than assuming that a generic curl option can resume safely.

Control Why it matters
Certificate verification Prevents silently sending files to an untrusted endpoint.
Explicit endpoint contract Prevents body-encoding errors that protocol changes cannot fix.
Negotiated-protocol logging Shows whether HTTP/2 was actually used through the proxy path.
Idempotency and duplicate policy Prevents unsafe automatic retries and accidental overwrites.
Patched curl/libcurl Addresses implementation vulnerabilities, including current HTTP/2 upload advisories.

A practical selection checklist

  • Read the API documentation and classify the body as direct PUT, multipart, or another specified format.
  • Use an HTTPS URL and verify the certificate chain and hostname.
  • Confirm HTTP2 appears in curl --version before requesting HTTP/2.
  • Start with --http2, not prior knowledge, for ordinary HTTPS.
  • Use --http1.1 when a known intermediary or origin cannot reliably handle HTTP/2.
  • Use --http2-prior-knowledge only for a documented direct h2 service, especially on cleartext connections.
  • Verify the negotiated protocol and response status with verbose or trace output.
  • Use --form-string for untrusted literal form values.
  • Benchmark the actual endpoint with realistic file sizes, concurrency, latency, and proxy routes.
  • Check the curl project’s current security advisories before standardizing a client version.

Bottom line for common upload commands

Direct PUT over negotiated HTTP/2

curl --http2 --upload-file ./archive.zip https://example.example/upload

Use this when the server defines PUT as the upload operation and your client, server, and intermediaries can negotiate HTTP/2.

Multipart form over negotiated HTTP/2

curl --http2 --form 'file=@./archive.zip' https://example.example/upload

Use this when the server expects a multipart field named file, adding documented fields as needed.

Compatibility fallback

curl --http1.1 --upload-file ./archive.zip https://example.example/upload

Use the fallback when diagnostics show that HTTP/2 fails in the target path. The correct protocol is the one that satisfies the endpoint contract, preserves transport security, and works reliably for your measured workload.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

curlfile uploadsHTTP/1.1HTTP/2HTTPSmultipart/form-dataPUTWeb APIs

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Crashes, No Sound, or Screen Glitches?Free driver scan

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.