new file mode 100644
@@ -0,0 +1,155 @@
+From 2956af6c7451029fb12c12f8166dff211f930d52 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 3 Sep 2026 17:54:45 +0200
+Subject: [PATCH] HTTP-CONNECT: do not react to 401 responses
+
+When a proxy answers with a 401 on a CONNECT, ignore Authentication
+headers and fail the connect.
+
+Add test2173 to verify.
+
+Closes #22817
+
+CVE: CVE-2026-86414
+Upstream-Status: Backport [https://github.com/curl/curl/commit/2956af6c7451029fb12c12f8166dff211f930d52]
+
+Backport Changes:
+- Omitted the on_resp_header_udp() hunk: curl 8.19.0 has no separate
+ CONNECT-UDP response handler.
+- Applied the Curl_http_proxy_inspect_tunnel_response() change to
+ inspect_response() in lib/cf-h2-proxy.c, where curl 8.19.0 handles
+ HTTP/2 CONNECT responses. It uses ts->resp from the tunnel state
+ instead of upstream's resp argument.
+- Registered test2173 in the older compact TESTCASES list without
+ upstream's extra blank continuation line.
+- Changed test2173's expected error from 7 (CURLE_COULDNT_CONNECT)
+ to 56 (CURLE_RECV_ERROR). curl 8.19.0 reports this rejected CONNECT
+ as a receive error; upstream reports it as a connection failure.
+
+(cherry picked from commit 2956af6c7451029fb12c12f8166dff211f930d52)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cf-h1-proxy.c | 3 +--
+ lib/cf-h2-proxy.c | 5 +---
+ tests/data/Makefile.am | 1 +
+ tests/data/test2173 | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 4 files changed, 71 insertions(+), 6 deletions(-)
+
+diff --git a/lib/cf-h1-proxy.c b/lib/cf-h1-proxy.c
+index 69e050b..fc68957 100644
+--- a/lib/cf-h1-proxy.c
++++ b/lib/cf-h1-proxy.c
+@@ -277,8 +277,7 @@ static CURLcode on_resp_header(struct Curl_cfilter *cf,
+ struct SingleRequest *k = &data->req;
+ (void)cf;
+
+- if((checkprefix("WWW-Authenticate:", header) && (401 == k->httpcode)) ||
+- (checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode))) {
++ if(checkprefix("Proxy-authenticate:", header) && (407 == k->httpcode)) {
+
+ bool proxy = (k->httpcode == 407);
+ char *auth = Curl_copy_header_value(header);
+diff --git a/lib/cf-h2-proxy.c b/lib/cf-h2-proxy.c
+index 4275e1e..719f9b8 100644
+--- a/lib/cf-h2-proxy.c
++++ b/lib/cf-h2-proxy.c
+@@ -788,10 +788,7 @@ static CURLcode inspect_response(struct Curl_cfilter *cf,
+ return CURLE_OK;
+ }
+
+- if(ts->resp->status == 401) {
+- auth_reply = Curl_dynhds_cget(&ts->resp->headers, "WWW-Authenticate");
+- }
+- else if(ts->resp->status == 407) {
++ if(ts->resp->status == 407) {
+ auth_reply = Curl_dynhds_cget(&ts->resp->headers, "Proxy-Authenticate");
+ }
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index e157596..95a8fe4 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -257,6 +257,7 @@ test2072 test2073 test2074 test2075 test2076 test2077 test2078 test2079 \
+ test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
+ test2088 test2089 test2090 test2091 \
+ test2100 test2101 test2102 test2103 test2104 \
++test2173 \
+ \
+ test2200 test2201 test2202 test2203 test2204 test2205 \
+ \
+diff --git a/tests/data/test2173 b/tests/data/test2173
+new file mode 100644
+index 0000000..fb85f40
+--- /dev/null
++++ b/tests/data/test2173
+@@ -0,0 +1,68 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP CONNECT
++HTTP Basic auth
++proxytunnel
++</keywords>
++</info>
++# Server-side
++<reply>
++<data>
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake swsclose
++Content-Type: text/html
++Funny-head: yesyes
++Content-Length: 9
++
++contents
++</data>
++<connect crlf="headers">
++HTTP/1.1 401 Tricking You
++WWW-Authenticate: Basic
++
++</connect>
++<datacheck crlf="headers">
++HTTP/1.1 401 Tricking You
++WWW-Authenticate: Basic
++
++</datacheck>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++http-proxy
++</server>
++<name>
++HTTP over proxy-tunnel with site wrong 401 response
++</name>
++<command>
++http://test.%TESTNUMBER:%HTTPPORT/we/want/that/page/%TESTNUMBER -p -x %HOSTIP:%PROXYPORT --user 'iam:my:;self' --anyauth
++</command>
++<features>
++proxy
++</features>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<proxy crlf="headers">
++CONNECT test.%TESTNUMBER:%HTTPPORT HTTP/1.1
++Host: test.%TESTNUMBER:%HTTPPORT
++User-Agent: curl/%VERSION
++Proxy-Connection: Keep-Alive
++
++</proxy>
++<protocol crlf="headers">
++</protocol>
++<errorcode>
++56
++</errorcode>
++</verify>
++</testcase>
+--
+2.35.6
@@ -48,6 +48,7 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-82208.patch \
file://CVE-2026-80230.patch \
file://CVE-2026-80231.patch \
+ file://CVE-2026-86414.patch \
"
SRC_URI:append:class-nativesdk = " \