mbox series

[wrynose,00/12] curl: Security fixes

Message ID 20261104073627.302002-1-dkelaiya@cisco.com
Headers show
Series curl: Security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 7:36 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport eleven security fixes to curl 8.19.0 on Wrynose and add
a configuration-dependent status for CVE-2026-19931.

This series applies on top of my submitted five-patch curl v2
series, "curl: backport security fixes" [1]. Apply all five patches
from that series first.

The source fixes address proxy authentication, AWS SigV4 reset,
HSTS imports, control-response processing, cookie-jar loading,
GnuTLS sends, IMAP APPEND, TFTP direction checks, hashed known_hosts
matching and HTTP/2 push-handle share ownership.

The CVE-2026-92386 backport includes the upstream correction for
serialized cookie-jar record limits. The CVE-2026-87865 backport
includes the follow-up that avoids repeated known_hosts scans.

The CVE-2026-18924 fix replaces the earlier Wrynose submission [2]
that failed compilation in the pull review [3]. It uses the available
curl_easy_setopt() share setter with a CURLSH * cast instead of
Curl_share_easy_link().

For CVE-2026-19931, record not-applicable-config if either krb5 or
negotiate-auth is absent from PACKAGECONFIG. Builds enabling both
options retain unpatched status pending a source backport.

[1] https://lists.openembedded.org/g/openembedded-core/message/248493
[2] https://lists.openembedded.org/g/openembedded-core/message/245495
[3] https://lists.openembedded.org/g/openembedded-core/message/246648

Darsh Kelaiya (12):
  curl: fix CVE-2026-86414
  curl: fix CVE-2026-86409
  curl: fix CVE-2026-87862
  curl: fix CVE-2026-92387
  curl: fix CVE-2026-86412
  curl: fix CVE-2026-92386
  curl: fix CVE-2026-107928
  curl: fix CVE-2026-87864
  curl: fix CVE-2026-92389
  curl: fix CVE-2026-87865
  curl: set CVE_STATUS for CVE-2026-19931
  curl: fix CVE-2026-18924

 .../curl/curl/CVE-2026-107928.patch           |  40 ++++
 .../curl/curl/CVE-2026-18924.patch            |  57 +++++
 .../curl/curl/CVE-2026-86409.patch            |  88 +++++++
 .../curl/curl/CVE-2026-86412.patch            |  34 +++
 .../curl/curl/CVE-2026-86414.patch            | 155 ++++++++++++
 .../curl/curl/CVE-2026-87862.patch            | 147 ++++++++++++
 .../curl/curl/CVE-2026-87864.patch            |  55 +++++
 .../curl/curl/CVE-2026-87865_p1.patch         | 225 ++++++++++++++++++
 .../curl/curl/CVE-2026-87865_p2.patch         |  89 +++++++
 .../curl/curl/CVE-2026-92386_p1.patch         |  33 +++
 .../curl/curl/CVE-2026-92386_p2.patch         | 146 ++++++++++++
 .../curl/curl/CVE-2026-92387.patch            |  43 ++++
 .../curl/curl/CVE-2026-92389.patch            |  56 +++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  16 ++
 14 files changed, 1184 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-107928.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-18924.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86409.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86412.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86414.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87862.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87864.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87865_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87865_p2.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92386_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92386_p2.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92387.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92389.patch