diff mbox series

[scarthgap,2/2] curl: fix CVE-2026-87864

Message ID 20261030085825.14343-1-adarsh.jagadish.kamini@est.tech
State Awaiting Upstream
Delegated to: Yoann Congal
Headers show
Series [scarthgap,1/2] curl: fix CVE-2026-92388 | expand

Commit Message

Adarsh Jagadish Kamini Oct. 30, 2026, 8:58 a.m. UTC 
Backport patch to fix CVE-2026-87864.

References:
  https://nvd.nist.gov/vuln/detail/CVE-2026-87864

Upstream fix:
  https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797

Tested with ptest:
Before: PASSED: 857, FAILED: 0, SKIPPED: 0, ABORTED: 0
After: PASSED: 857, FAILED: 0, SKIPPED: 0, ABORTED: 0

Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
---
 .../curl/curl/CVE-2026-87864.patch            | 52 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 53 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-87864.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-87864.patch b/meta/recipes-support/curl/curl/CVE-2026-87864.patch
new file mode 100644
index 0000000000..9ddfb6054c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-87864.patch
@@ -0,0 +1,52 @@ 
+From 409f23eaf6c3a4573fa68db155010b4c9054601e Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 27 Aug 2026 09:47:53 +0200
+Subject: [PATCH] imap: APPEND CRLF fix
+
+Deny an APPEND operation with CRLF conversion requested as we are unable
+to predict the final upload size and APPEND requires us to announce it
+before starting the upload.
+
+The check for unknown sizes had already been there, but the crlf
+conversion that renders a known size unknown was not accounted for.
+
+Closes #22702
+
+CVE: CVE-2026-87864
+Upstream-Status: Backport [https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae797]
+
+Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
+---
+ lib/imap.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+diff --git a/lib/imap.c b/lib/imap.c
+index 0e013e740a..6e4194b0cf 100644
+--- a/lib/imap.c
++++ b/lib/imap.c
+@@ -790,7 +790,6 @@ static CURLcode imap_perform_append(struct Curl_easy *data)
+       result = Curl_creader_set_mime(data, &data->set.mimepost);
+     if(result)
+       return result;
+-    data->state.infilesize = Curl_creader_client_length(data);
+   }
+   else
+ #endif
+@@ -800,9 +799,15 @@ static CURLcode imap_perform_append(struct Curl_easy *data)
+       return result;
+   }
+ 
+-  /* Check we know the size of the upload */
++  /* Check we know the size of the upload. This takes all readers
++   * into account. Especially crlf conversions which make the size
++   * unpredictable, e.g. -1. */
++  data->state.infilesize = Curl_creader_total_length(data);
+   if(data->state.infilesize < 0) {
+-    failf(data, "Cannot APPEND with unknown input file size");
++    if(data->set.crlf)
++      failf(data, "Cannot APPEND with CRLF conversion making size unknown");
++    else
++      failf(data, "Cannot APPEND with unknown input file size");
+     return CURLE_UPLOAD_FAILED;
+   }
+ 
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 3e4d2a1f9f..b4db387262 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -45,6 +45,7 @@  SRC_URI = " \
     file://CVE-2026-8286.patch \
     file://CVE-2026-92388-1.patch \
     file://CVE-2026-92388-2.patch \
+    file://CVE-2026-87864.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \