new file mode 100644
@@ -0,0 +1,212 @@
+From 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 25 Aug 2026 13:47:11 +0200
+Subject: [PATCH] vtls: move 'native_ca_store' ssl_config_data =>
+ ssl_primary_config
+
+And include it as key for connection reuse matching.
+
+Reported-by: Stanislav Fort
+
+Closes #22668
+
+CVE: CVE-2026-80231
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42]
+
+Backport Changes:
+- Moved the SSL config structures to lib/urldata.h and matching,
+ cloning and option completion to lib/vtls/vtls.c. Curl 8.19.0
+ does not provide lib/vtls/vtls_config.[ch].
+- Omitted the ossl_apply_session() hunk because curl 8.19.0 has no
+ corresponding session-verification path.
+- Retained the older GnuTLS verification layout and helper names.
+
+(cherry picked from commit 7be1e70cb6bcd83e130ecfe8cb91b6a7dcdeff42)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/urldata.h | 2 +-
+ lib/vtls/gtls.c | 6 +++---
+ lib/vtls/openssl.c | 7 +++----
+ lib/vtls/rustls.c | 2 +-
+ lib/vtls/vtls.c | 8 +++++---
+ lib/vtls/wolfssl.c | 5 ++---
+ 6 files changed, 15 insertions(+), 15 deletions(-)
+
+diff --git a/lib/urldata.h b/lib/urldata.h
+index dce181d..0bc9ade 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -249,6 +249,7 @@ struct ssl_primary_config {
+ BIT(verifypeer); /* set TRUE if this is desired */
+ BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */
+ BIT(verifystatus); /* set TRUE if certificate status must be checked */
++ BIT(native_ca_store); /* use the native CA store of operating system */
+ BIT(cache_session); /* cache session or not */
+ };
+
+@@ -264,7 +265,6 @@ struct ssl_config_data {
+ BIT(no_partialchain); /* do not accept partial certificate chains */
+ BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation
+ list errors */
+- BIT(native_ca_store); /* use the native CA store of operating system */
+ BIT(auto_client_cert); /* automatically locate and use a client
+ certificate for authentication (Schannel) */
+ BIT(custom_cafile); /* application has set custom CA file */
+diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
+index bfeb948..f19940a 100644
+--- a/lib/vtls/gtls.c
++++ b/lib/vtls/gtls.c
+@@ -451,7 +451,7 @@ static CURLcode gtls_populate_creds(struct Curl_cfilter *cf,
+ }
+
+ infof(data, "SSL Trust Anchors:");
+- if(ssl_config->native_ca_store) {
++ if(config->native_ca_store) {
+ #ifdef USE_APPLE_SECTRUST
+ infof(data, " Native: Apple SecTrust");
+ creds_are_empty = FALSE;
+@@ -655,7 +655,7 @@ CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf,
+ !conn_config->CApath &&
+ !conn_config->ca_info_blob &&
+ !ssl_config->primary.CRLfile &&
+- !ssl_config->native_ca_store &&
++ !conn_config->native_ca_store &&
+ !conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */
+
+ if(cache_criteria_met)
+@@ -1659,7 +1659,7 @@ CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf,
+ infof(data, " SSL certificate verified by GnuTLS");
+
+ #ifdef USE_APPLE_SECTRUST
+- if(!verified && ssl_config->native_ca_store) {
++ if(!verified && config->native_ca_store) {
+ result = glts_apple_verify(cf, data, peer, &chain, &verified);
+ if(result && (result != CURLE_PEER_FAILED_VERIFICATION))
+ goto out; /* unexpected error */
+diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
+index 1cf357c..e162114 100644
+--- a/lib/vtls/openssl.c
++++ b/lib/vtls/openssl.c
+@@ -3034,7 +3034,6 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
+ X509_STORE *store)
+ {
+ struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
+- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+ CURLcode result = CURLE_OK;
+ const char * const ssl_cafile =
+ /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+@@ -3043,7 +3042,7 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
+ bool have_native_check = FALSE;
+
+ octx->store_is_empty = TRUE;
+- if(ssl_config->native_ca_store) {
++ if(conn_config->native_ca_store) {
+ #ifdef USE_WIN32_CRYPTO
+ bool added = FALSE;
+ result = ossl_windows_load_anchors(cf, data, store, &added);
+@@ -3352,7 +3351,7 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
+ !conn_config->CApath &&
+ !conn_config->ca_info_blob &&
+ !ssl_config->primary.CRLfile &&
+- !ssl_config->native_ca_store;
++ !conn_config->native_ca_store;
+
+ ERR_set_mark();
+
+@@ -4834,7 +4833,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+ infof(data, "SSL certificate verified via OpenSSL.");
+
+ #ifdef USE_APPLE_SECTRUST
+- if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) {
++ if(!verified && conn_config->verifypeer && conn_config->native_ca_store) {
+ /* we verify using Apple SecTrust *unless* OpenSSL already verified.
+ * This may happen if the application intercepted the OpenSSL callback
+ * and installed its own. */
+diff --git a/lib/vtls/rustls.c b/lib/vtls/rustls.c
+index 564b10a..8961943 100644
+--- a/lib/vtls/rustls.c
++++ b/lib/vtls/rustls.c
+@@ -1035,7 +1035,7 @@ static CURLcode cr_init_backend(struct Curl_cfilter *cf,
+ rustls_client_config_builder_dangerous_set_certificate_verifier(
+ config_builder, cr_verify_none);
+ }
+- else if(ssl_config->native_ca_store) {
++ else if(conn_config->native_ca_store) {
+ result = init_config_builder_platform_verifier(data, config_builder);
+ if(result != CURLE_OK) {
+ rustls_client_config_builder_free(config_builder);
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index 35cb4f0..a3ed81b 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -198,6 +198,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
+ if((c1->version == c2->version) &&
+ (c1->version_max == c2->version_max) &&
+ (c1->ssl_options == c2->ssl_options) &&
++ (c1->native_ca_store == c2->native_ca_store) &&
+ (c1->verifypeer == c2->verifypeer) &&
+ (c1->verifyhost == c2->verifyhost) &&
+ (c1->verifystatus == c2->verifystatus) &&
+@@ -251,6 +252,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+ dest->verifypeer = source->verifypeer;
+ dest->verifyhost = source->verifyhost;
+ dest->verifystatus = source->verifystatus;
++ dest->native_ca_store = source->native_ca_store;
+ dest->cache_session = source->cache_session;
+ dest->ssl_options = source->ssl_options;
+
+@@ -312,7 +314,7 @@ static void ssl_easy_config_compl_options(struct ssl_config_data *sslc)
+ /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
+ * If not, we switch it on for supported backends if no custom
+ * ca settings exist. */
+- sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
++ sslc->primary.native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
+ sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
+ sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
+ sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
+@@ -335,7 +337,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+ if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+- sslc->native_ca_store = TRUE;
++ sslc->primary.native_ca_store = TRUE;
+ #endif
+ #ifdef CURL_CA_PATH
+ if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH]) {
+@@ -384,7 +386,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
+ if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+- sslc->native_ca_store = TRUE;
++ sslc->primary.native_ca_store = TRUE;
+ #endif
+ #ifdef CURL_CA_PATH
+ if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) {
+diff --git a/lib/vtls/wolfssl.c b/lib/vtls/wolfssl.c
+index fdf33a8..c901ebf 100644
+--- a/lib/vtls/wolfssl.c
++++ b/lib/vtls/wolfssl.c
+@@ -593,13 +593,12 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
+ /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
+ (ca_info_blob ? NULL : conn_config->CAfile);
+ const char * const ssl_capath = conn_config->CApath;
+- struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
+ bool imported_native_ca = FALSE;
+ bool imported_ca_info_blob = FALSE;
+
+ #ifndef NO_FILESYSTEM
+ /* load native CA certificates */
+- if(ssl_config->native_ca_store) {
++ if(conn_config->native_ca_store) {
+ #ifdef WOLFSSL_SYS_CA_CERTS
+ if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) {
+ infof(data, "error importing native CA store, continuing anyway");
+@@ -810,7 +809,7 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
+ !conn_config->CApath &&
+ !conn_config->ca_info_blob &&
+ !ssl_config->primary.CRLfile &&
+- !ssl_config->native_ca_store;
++ !conn_config->native_ca_store;
+
+ cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data)
+ : NULL;
@@ -46,6 +46,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-80255.patch \
file://CVE-2026-82208.patch \
file://CVE-2026-80230.patch \
+ file://CVE-2026-80231.patch \
"
SRC_URI:append:class-nativesdk = " \