new file mode 100644
@@ -0,0 +1,202 @@
+From 01ce94b67888e6efa4196247302e59cf68e77b2d Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 13 Jul 2026 23:13:37 -0700
+Subject: [PATCH] creds: add sasl service name
+
+The SASL service name, used in authentication, is part of curl's credentials
+when authenticating to a server/proxy. Make it part of `struct Curl_creds`.
+
+Change code to use `creds` to obtain a service name. By tying creds used
+to the connection, connection reuse is also only allowed when the service
+name matches.
+
+Closes #21585
+
+CVE: CVE-2026-8458
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d]
+
+Backport Changes:
+- Wrynose curl 8.19.0 does not have upstream struct Curl_creds.
+ This backport stores the optional SASL service name on the existing
+ connectdata/proxy_info structures and compares it during connection
+ reuse for the same security behavior.
+- Omitted the upstream unit1304 Curl_creds_create() signature
+ adjustment because Wrynose 8.19.0 does not contain Curl_creds.
+
+(cherry picked from commit 5e99b73cf441d9c369768b9cd48b5389b9a2503d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 61 ++++++++++++++++++++++++++++++++++++++++++++++-----
+ lib/urldata.h | 2 ++
+ 2 files changed, 58 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 6c1375f8e3..35f467daf2 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -535,12 +535,15 @@ void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn)
+ Curl_safefree(conn->socks_proxy.user);
+ Curl_safefree(conn->http_proxy.passwd);
+ Curl_safefree(conn->socks_proxy.passwd);
++ Curl_safefree(conn->http_proxy.sasl_service_name);
++ Curl_safefree(conn->socks_proxy.sasl_service_name);
+ Curl_safefree(conn->http_proxy.host.rawalloc); /* http proxy name buffer */
+ Curl_safefree(conn->socks_proxy.host.rawalloc); /* socks proxy name buffer */
+ #endif
+ Curl_safefree(conn->user);
+ Curl_safefree(conn->passwd);
+ Curl_safefree(conn->sasl_authzid);
++ Curl_safefree(conn->sasl_service_name);
+ Curl_safefree(conn->options);
+ Curl_safefree(conn->oauth_bearer);
+ Curl_safefree(conn->host.rawalloc); /* hostname buffer */
+@@ -593,7 +596,9 @@ static bool proxy_info_matches(const struct proxy_info *data,
+ curl_strequal(data->host.name, needle->host.name)) {
+
+ if(Curl_timestrcmp(data->user, needle->user) ||
+- Curl_timestrcmp(data->passwd, needle->passwd))
++ Curl_timestrcmp(data->passwd, needle->passwd) ||
++ Curl_timestrcmp(data->sasl_service_name,
++ needle->sasl_service_name))
+ return FALSE;
+ return TRUE;
+ }
+@@ -1035,6 +1040,8 @@ static bool url_match_auth(struct connectdata *conn,
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+ Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
+ Curl_timestrcmp(m->needle->sasl_authzid, conn->sasl_authzid) ||
++ Curl_timestrcmp(m->needle->sasl_service_name,
++ conn->sasl_service_name) ||
+ Curl_timestrcmp(m->needle->oauth_bearer, conn->oauth_bearer)) {
+ /* one of them was different */
+ return FALSE;
+@@ -1116,7 +1123,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+ partway through a handshake!) */
+ if(m->want_ntlm_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+- Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
++ Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++ Curl_timestrcmp(m->needle->sasl_service_name,
++ conn->sasl_service_name)) {
+ /* we prefer a credential match, but this is at least a connection
+ that can be reused and "upgraded" to NTLM if it does
+ not have any auth ongoing. */
+@@ -1147,7 +1156,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+ if(Curl_timestrcmp(m->needle->http_proxy.user,
+ conn->http_proxy.user) ||
+ Curl_timestrcmp(m->needle->http_proxy.passwd,
+- conn->http_proxy.passwd))
++ conn->http_proxy.passwd) ||
++ Curl_timestrcmp(m->needle->http_proxy.sasl_service_name,
++ conn->http_proxy.sasl_service_name))
+ return FALSE;
+ }
+ else if(conn->proxy_ntlm_state != NTLMSTATE_NONE) {
+@@ -1188,7 +1199,9 @@ static bool url_match_auth_nego(struct connectdata *conn,
+ so that we can reuse Negotiate connections if possible. */
+ if(m->want_nego_http) {
+ if(Curl_timestrcmp(m->needle->user, conn->user) ||
+- Curl_timestrcmp(m->needle->passwd, conn->passwd))
++ Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++ Curl_timestrcmp(m->needle->sasl_service_name,
++ conn->sasl_service_name))
+ return FALSE;
+ }
+ else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+@@ -1207,7 +1220,9 @@ static bool url_match_auth_nego(struct connectdata *conn,
+ if(Curl_timestrcmp(m->needle->http_proxy.user,
+ conn->http_proxy.user) ||
+ Curl_timestrcmp(m->needle->http_proxy.passwd,
+- conn->http_proxy.passwd))
++ conn->http_proxy.passwd) ||
++ Curl_timestrcmp(m->needle->http_proxy.sasl_service_name,
++ conn->http_proxy.sasl_service_name))
+ return FALSE;
+ }
+ else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+@@ -3196,6 +3211,11 @@ static void url_conn_reuse_adjust(struct Curl_easy *data,
+ needle->user = NULL;
+ needle->passwd = NULL;
+ }
++ if(needle->sasl_service_name) {
++ curlx_free(conn->sasl_service_name);
++ conn->sasl_service_name = needle->sasl_service_name;
++ needle->sasl_service_name = NULL;
++ }
+
+ #ifndef CURL_DISABLE_PROXY
+ conn->bits.proxy_user_passwd = needle->bits.proxy_user_passwd;
+@@ -3214,6 +3234,17 @@ static void url_conn_reuse_adjust(struct Curl_easy *data,
+ needle->http_proxy.passwd = NULL;
+ needle->socks_proxy.passwd = NULL;
+ }
++ if(needle->http_proxy.sasl_service_name ||
++ needle->socks_proxy.sasl_service_name) {
++ curlx_free(conn->http_proxy.sasl_service_name);
++ curlx_free(conn->socks_proxy.sasl_service_name);
++ conn->http_proxy.sasl_service_name =
++ needle->http_proxy.sasl_service_name;
++ conn->socks_proxy.sasl_service_name =
++ needle->socks_proxy.sasl_service_name;
++ needle->http_proxy.sasl_service_name = NULL;
++ needle->socks_proxy.sasl_service_name = NULL;
++ }
+ #endif
+
+ /* Finding a connection for reuse in the cpool matches, among other
+@@ -3283,6 +3314,15 @@ static CURLcode url_create_needle(struct Curl_easy *data,
+ }
+ }
+
++ if(data->set.str[STRING_SERVICE_NAME]) {
++ needle->sasl_service_name =
++ curlx_strdup(data->set.str[STRING_SERVICE_NAME]);
++ if(!needle->sasl_service_name) {
++ result = CURLE_OUT_OF_MEMORY;
++ goto out;
++ }
++ }
++
+ if(data->set.str[STRING_BEARER]) {
+ needle->oauth_bearer = curlx_strdup(data->set.str[STRING_BEARER]);
+ if(!needle->oauth_bearer) {
+@@ -3310,6 +3350,17 @@ static CURLcode url_create_needle(struct Curl_easy *data,
+ if(result)
+ goto out;
+
++ if(data->set.str[STRING_PROXY_SERVICE_NAME]) {
++ result = Curl_setstropt(&needle->http_proxy.sasl_service_name,
++ data->set.str[STRING_PROXY_SERVICE_NAME]);
++ if(result)
++ goto out;
++ result = Curl_setstropt(&needle->socks_proxy.sasl_service_name,
++ data->set.str[STRING_PROXY_SERVICE_NAME]);
++ if(result)
++ goto out;
++ }
++
+ /*************************************************************
+ * If the protocol is using SSL and HTTP proxy is used, we set
+ * the tunnel_proxy bit.
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 6c6c83969c..1c369a54f2 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -586,6 +586,7 @@ struct proxy_info {
+ uint8_t proxytype; /* what kind of proxy that is in use */
+ char *user; /* proxy username string, allocated */
+ char *passwd; /* proxy password string, allocated */
++ char *sasl_service_name; /* SASL service name, allocated */
+ };
+
+ /*
+@@ -628,6 +629,7 @@ struct connectdata {
+ char *passwd; /* password string, allocated */
+ char *options; /* options string, allocated */
+ char *sasl_authzid; /* authorization identity string, allocated */
++ char *sasl_service_name; /* SASL service name, allocated */
+ char *oauth_bearer; /* OAUTH2 bearer, allocated */
+ struct curltime created; /* creation time */
+ struct curltime lastused; /* when returned to the connection poolas idle */
+--
+2.35.6
@@ -27,6 +27,7 @@ SRC_URI = " \
file://CVE-2026-8927.patch \
file://CVE-2026-8932-dependent.patch \
file://CVE-2026-8932.patch \
+ file://CVE-2026-8458.patch \
"
SRC_URI:append:class-nativesdk = " \