[wrynose,v2,0/5] curl: backport security fixes

From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport five security fixes to curl 8.19.0 on Wrynose.
The series addresses CVE-2026-8926, CVE-2026-11564,
CVE-2026-80255, CVE-2026-82208, and CVE-2026-80231.

This series is based on Jaipaul Cheernam's Wrynose patch
for CVE-2026-80230 [1]. Apply that patch first. The five
commits here add the remaining fixes on top of it.

Changes in v2:
- Address OE-core review comments:
- CVE-2026-8926 [2]: a later login in one machine entry can reuse
  the previous login's password (bob/p  1 instead of bob/p2).
  Select credentials after reading the whole entry, keeping its final
  login and password so both credential orderings select bob/p2.
  Extend tests/data/test1304 and tests/unit/unit1304.c for both
  orderings, replaced logins, account values and macros. Keep the
  old parser API and test harness, and document differences from
  upstream's lexer/scanner rewrite. Retain password-only entries
  and the old blank-password API.
- CVE-2026-11564 [3]: could retaining automatic client certificate
  selection introduce certificate confusion?
  Clarify that the backport preserves the existing Schannel opt-in
  assignment from CURLSSLOPT_AUTO_CLIENT_CERT, disabled by default.
  The native-CA setting is reset per transfer. The newer initial-origin
  restriction is not backported; Schannel redirect behavior has not
  been runtime tested.
- CVE-2026-80255 [4]: missing per-attribute validation can turn
  Secure<TAB>HttpOnly into an unknown attribute and lose Secure.
  Carry the earlier TAB-value fix and validation from [7] in separate
  dependent_p1 and dependent_p2 patches before the main TAB-handling
  fix. Adapt the validation to the older parser before attribute
  dispatch. Extend test 2885 to reject this malformed cookie, retaining
  the TAB-before-Secure case and normal Secure control.
- CVE-2026-82208 [5]: justify omitting the CURL_UNCONST ECH change
  and explain whether it affects ECH behavior.
  Explain that 8.19.0 already has a mutable char * from data->set.str,
  while upstream uses const char * from CURL_EASY_STR. The old pointer
  already matches the wolfSSL argument type; the ECH call and error
  handling are unchanged. Both store-setup security hunks are retained.
- CVE-2026-80231 [6]: justify omitting the ossl_apply_session() hunk
  and establish what verification handling exists in 8.19.0.
  Map the moved flag to lib/urldata.h and the SSL helpers to
  lib/vtls/vtls.c. Explain the GnuTLS function-name differences.
  The omitted OpenSSL hunk only updates a flag access inside a later
  SecTrust session-reuse exception. That exception and its cached
  verification field are absent from 8.19.0. Its existing session
  verification check remains unchanged.

[1] https://lists.openembedded.org/g/openembedded-core/message/248025
[2] https://lists.openembedded.org/g/openembedded-core/message/248286
[3] https://lists.openembedded.org/g/openembedded-core/message/248292
[4] https://lists.openembedded.org/g/openembedded-core/message/248294
[5] https://lists.openembedded.org/g/openembedded-core/message/248296
[6] https://lists.openembedded.org/g/openembedded-core/message/248297
[7] https://github.com/curl/curl/commit/67300814294ab0aa311b8568b460619ecc522949

Darsh Kelaiya (5):
  curl: fix CVE-2026-8926
  curl: fix CVE-2026-11564
  curl: fix CVE-2026-80255
  curl: fix CVE-2026-82208
  curl: fix CVE-2026-80231

 .../curl/curl/CVE-2026-11564.patch            | 139 ++++++++++
 .../curl/curl/CVE-2026-80231.patch            | 225 +++++++++++++++
 .../curl/CVE-2026-80255-dependent_p1.patch    | 139 ++++++++++
 .../curl/CVE-2026-80255-dependent_p2.patch    |  81 ++++++
 .../curl/curl/CVE-2026-80255.patch            | 115 ++++++++
 .../curl/curl/CVE-2026-82208.patch            |  54 ++++
 .../curl/curl/CVE-2026-8926-dependent.patch   | 140 ++++++++++
 .../curl/curl/CVE-2026-8926_p1.patch          | 258 ++++++++++++++++++
 .../curl/curl/CVE-2026-8926_p2.patch          |  84 ++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   9 +
 10 files changed, 1244 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-11564.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80231.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255-dependent_p2.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-82208.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8926_p2.patch