mbox series

[wrynose,0/5] curl: backport security fixes

Message ID 20261019064320.3978613-1-dkelaiya@cisco.com
Headers show
Series curl: backport security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Oct. 19, 2026, 6:43 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport five security fixes to curl 8.19.0 on Wrynose.
The series addresses CVE-2026-8926, CVE-2026-11564,
CVE-2026-80255, CVE-2026-82208, and CVE-2026-80231.

This series is based on Jaipaul Cheernam's Wrynose patch
for CVE-2026-80230 [1]. Apply that patch first. The five
commits here add the remaining fixes on top of it.

[1] https://lists.openembedded.org/g/openembedded-core/message/248025

Darsh Kelaiya (5):
  curl: fix CVE-2026-8926
  curl: fix CVE-2026-11564
  curl: fix CVE-2026-80255
  curl: fix CVE-2026-82208
  curl: fix CVE-2026-80231

 .../curl/curl/CVE-2026-11564.patch            | 132 +++++++++++
 .../curl/curl/CVE-2026-80231.patch            | 212 ++++++++++++++++++
 .../curl/curl/CVE-2026-80255-dependent.patch  | 139 ++++++++++++
 .../curl/curl/CVE-2026-80255.patch            | 125 +++++++++++
 .../curl/curl/CVE-2026-82208.patch            |  52 +++++
 .../curl/curl/CVE-2026-8926-dependent.patch   | 140 ++++++++++++
 .../curl/curl/CVE-2026-8926_p1.patch          | 100 +++++++++
 .../curl/curl/CVE-2026-8926_p2.patch          |  84 +++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   8 +
 9 files changed, 992 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch