mbox series

[scarthgap,0/3] curl: Security fixes

Message ID 20261104105645.2523473-1-dkelaiya@cisco.com
Headers show
Series curl: Security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 4, 2026, 10:56 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Update curl 8.7.1 on Scarthgap with the CVE-2026-18924 HTTP/2
server push fix. Record conditional status for CVE-2026-19931 and
Linux platform status for CVE-2026-80231.

This series is based on Jaipaul Cheernam's CVE-2026-80230 curl
patch in the Scarthgap pull request [3]. Apply that patch first.

The CVE-2026-18924 patch replaces the earlier Scarthgap submission [1]
rejected for compilation failure, as documented in the review of
that failure [2]. The backport used Curl_share_easy_link(), which is
absent from curl 8.7.1. The replacement uses curl_easy_setopt()
with CURLOPT_SHARE to retain the share setter's reference counting
and cleanup handling.

For CVE-2026-19931, record not-applicable-config unless both krb5
and negotiate-auth are enabled in PACKAGECONFIG; otherwise retain
unpatched status.

[1] https://lists.openembedded.org/g/openembedded-core/message/245542
[2] https://lists.openembedded.org/g/openembedded-core/message/246572
[3] https://lists.openembedded.org/g/openembedded-core/message/249301

Darsh Kelaiya (3):
  curl: set CVE_STATUS for CVE-2026-19931
  curl: fix CVE-2026-18924
  curl: set CVE_STATUS for CVE-2026-80231

 .../curl/curl/CVE-2026-18924.patch            | 56 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  3 +
 2 files changed, 59 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-18924.patch