new file mode 100644
@@ -0,0 +1,81 @@
+From 90ff17f6bfe1d358c26fa25ab457bc420a9847b2 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+CVE: CVE-2026-8286
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
+
+Backport Changes:
+- Wrynose applies upstream commit [1] before this patch. That commit
+ adds req_tls to struct url_conn_match and initializes it in
+ url_attach_existing().
+- This backport replaces that local req_tls state with the upstream
+ may_tls/require_tls split and updates url_match_ssl_use(),
+ url_match_ssl_config(), and url_attach_existing() to preserve the
+ upstream STARTTLS reuse behavior on the Wrynose 8.19.0 codebase.
+
+[1] https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 4ebff50ef1..6c1375f8e3 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -745,7 +745,11 @@ struct url_conn_match {
+ BIT(want_proxy_ntlm_http);
+ BIT(want_nego_http);
+ BIT(want_proxy_nego_http);
+- BIT(req_tls); /* require TLS use from a clear-text start */
++ BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse
++ * connections that have matching TLS configuration.
++ * Always TRUE if `req_tls` is TRUE. */
++ BIT(require_tls); /* Requires TLS use from a clear-text start, can only
++ * reuse connections that have TLS. */
+ BIT(wait_pipe);
+ BIT(force_reuse);
+ BIT(seen_pending_conn);
+@@ -897,7 +901,7 @@ static bool url_match_ssl_use(struct connectdata *conn,
+ (get_protocol_family(conn->scheme) != m->needle->scheme->protocol))
+ return FALSE;
+ }
+- else if(m->req_tls)
++ else if(m->require_tls)
+ /* a clear-text STARTTLS protocol with required TLS */
+ return FALSE;
+ return TRUE;
+@@ -1090,8 +1094,8 @@ static bool url_match_destination(struct connectdata *conn,
+ static bool url_match_ssl_config(struct connectdata *conn,
+ struct url_conn_match *m)
+ {
+- /* If talking TLS, conn needs to use the same SSL options. */
+- if((m->needle->scheme->flags & PROTOPT_SSL) &&
++ /* If talking/upgrading to TLS, conn needs to use the same SSL options. */
++ if(((m->needle->scheme->flags & PROTOPT_SSL) || m->may_tls) &&
+ !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {
+ DEBUGF(infof(m->data, "Connection #%" FMT_OFF_T
+ " has different SSL parameters, cannot reuse",
+@@ -1364,7 +1368,8 @@ static bool url_attach_existing(struct Curl_easy *data,
+ (needle->scheme->protocol & PROTO_FAMILY_HTTP);
+ #endif
+ #endif
+- match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++ match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++ match.may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+
+ /* Find a connection in the pool that matches what "data + needle"
+ * requires. If a suitable candidate is found, it is attached to "data". */
+--
+2.35.6
@@ -23,6 +23,7 @@ SRC_URI = " \
file://CVE-2026-6429.patch \
file://CVE-2026-7168.patch \
file://CVE-2026-4873.patch \
+ file://CVE-2026-8286.patch \
"
SRC_URI:append:class-nativesdk = " \