mbox series

[scarthgap,0/7] curl: fix High scored CVEs

Message ID 20261106144134.1370928-1-joaomarcos.costa@bootlin.com
Headers show
Series curl: fix High scored CVEs | expand

Message

João Marcos Costa (Schneider Electric) Nov. 6, 2026, 2:41 p.m. UTC 
Hello,

Not all of the backports include new test cases, but I tested this
series anyway with core-image-ptest-curl (qemux86-64) and I didn't
observe any failures, aside from one info in 3595:

(...)
PASS: 3020 - HTTP with invalid --connect-to syntax
PASS: 3025 - CURLOPT_HTTP200ALIASES
PASS: 3026 - curl_global_init thread-safety
PASS: 3029 - HTTP with multiple -D
PASS: 3030 - HTTP with multiple transfers in one -D
PASS: 3101 - HTTP auth without redirection protocols
PASS: 3103 - CURLOPT_COOKIELIST without expiry
Test case 3595 has no server(s) specified at runner.pm line 599.
PASS: 3201 - HTTP GET when PROXY Protocol enabled and spoofed client IP
PASS: 3202 - HTTP-IPv6 GET with PROXY protocol with spoofed client IP
PASS: 3028 - HTTP GET when PROXY Protocol enabled behind a proxy
TESTDONE: 1701 tests were considered during 177 seconds.
TESTDONE: 858 tests out of 858 reported OK: 100%

Best regards,

João Marcos Costa (Schneider Electric) (7):
  curl: fix CVE-2026-86409
  curl: fix CVE-2026-87864
  curl: fix CVE-2026-87865
  curl: fix CVE-2026-92386
  curl: fix CVE-2026-92389
  curl: fix CVE-2026-92391
  curl: fix CVE-2026-94266

 .../curl/curl/CVE-2026-86409.patch            |  36 +++
 .../curl/curl/CVE-2026-87864.patch            |  55 ++++
 .../curl/curl/CVE-2026-87865.patch            | 212 ++++++++++++
 .../curl/curl/CVE-2026-92386.patch            |  32 ++
 .../curl/curl/CVE-2026-92389.patch            |  56 ++++
 .../curl/curl/CVE-2026-92391.patch            | 185 +++++++++++
 .../curl/curl/CVE-2026-94266-pre.patch        | 302 ++++++++++++++++++
 .../curl/curl/CVE-2026-94266.patch            | 222 +++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |   8 +
 9 files changed, 1108 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86409.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87864.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87865.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92386.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92389.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92391.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-94266-pre.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-94266.patch