mbox series

[wrynose,0/9] curl: Security fixes

Message ID 20261106071932.490299-1-dkelaiya@cisco.com
Headers show
Series curl: Security fixes | expand

Message

Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) Nov. 6, 2026, 7:19 a.m. UTC 
From: Darsh Kelaiya <dkelaiya@cisco.com>

Backport nine additional security fixes to curl 8.19.0 on Wrynose.

This series applies on top of my earlier curl CVE series [1],
from CVE-2026-86414 through CVE-2026-18924.

These commits address MIME cleanup, HSTS expiration, SSH host
verification on redirects, output-file handling, FTP wildcard
callbacks, connection cleanup, credential removal from effective
URLs, interface-bound connection reuse and certificate parsing.

The CVE-2026-94266 commit includes the Git 2.53.0 compatibility
backport needed for the effective-URL behavior change. Keep that
companion change with the curl fix.

The CVE-2026-87866 commit carries the source fix for wolfSSL
pinning, including the shared ASN.1 parser and affected TLS callers.

[1] https://lists.openembedded.org/g/openembedded-core/message/249332

Darsh Kelaiya (9):
  curl: fix CVE-2026-92391
  curl: fix CVE-2026-87863
  curl: fix CVE-2026-86410
  curl: fix CVE-2026-92390
  curl: fix CVE-2026-92388
  curl: fix CVE-2026-92392
  curl: fix CVE-2026-94266
  curl: fix CVE-2026-107929
  curl: fix CVE-2026-87866

 ...l-stripping-creds-from-effective-url.patch | 140 ++++
 meta/recipes-devtools/git/git_2.53.0.bb       |   1 +
 .../curl/curl/CVE-2026-107929.patch           | 470 +++++++++++
 .../curl/curl/CVE-2026-86410.patch            | 102 +++
 .../curl/curl/CVE-2026-87863.patch            | 203 +++++
 .../curl/curl/CVE-2026-87866.patch            | 750 ++++++++++++++++++
 .../curl/curl/CVE-2026-92388_p1.patch         | 139 ++++
 .../curl/curl/CVE-2026-92388_p2.patch         |  33 +
 .../curl/curl/CVE-2026-92390_p1.patch         | 270 +++++++
 .../curl/curl/CVE-2026-92390_p2.patch         | 150 ++++
 .../curl/curl/CVE-2026-92391.patch            | 203 +++++
 .../curl/curl/CVE-2026-92392.patch            |  59 ++
 .../curl/curl/CVE-2026-94266_p1.patch         | 225 ++++++
 .../curl/curl/CVE-2026-94266_p2.patch         | 235 ++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |  12 +
 15 files changed, 2992 insertions(+)
 create mode 100644 meta/recipes-devtools/git/git/0001-http-handle-curl-stripping-creds-from-effective-url.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-107929.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86410.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87863.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87866.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92388_p2.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92390_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92390_p2.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92391.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92392.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-94266_p1.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-94266_p2.patch

Comments

Yoann Congal Nov. 6, 2026, 9 a.m. UTC | #1 
Hello,

On Fri Nov 6, 2026 at 8:19 AM CET, Darsh Kelaiya -X (dkelaiya - E INFOCHIPS PRIVATE LIMITED at Cisco) via openembedded-core wrote:
> From: Darsh Kelaiya <dkelaiya@cisco.com>
>
> Backport nine additional security fixes to curl 8.19.0 on Wrynose.
>
> This series applies on top of my earlier curl CVE series [1],
> from CVE-2026-86414 through CVE-2026-18924.

May I ask that you use unique subjects for the cover letters?
Either put the date or maybe the CVE range if that makes sense.
This will make it easier to track them.

Thanks!