diff mbox series

[scarthgap,1/7] curl: fix CVE-2026-86409

Message ID 20261106144134.1370928-2-joaomarcos.costa@bootlin.com
State Under Review
Delegated to: Jérémy ROSEN
Headers show
Series curl: fix High scored CVEs | expand

Commit Message

João Marcos Costa (Schneider Electric) Nov. 6, 2026, 2:41 p.m. UTC 
This vulnerability, marked as High [1], was fixed upstream [2] since
v8.22.0.

Backport the fix to curl v8.7.1.

The only changes not included in the backport are the ones related to
test1978, which is not available in v8.7.1.

[1] https://nvd.nist.gov/vuln/detail/cve-2026-86409
[2] https://curl.se/docs/CVE-2026-86409.html

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
---
 .../curl/curl/CVE-2026-86409.patch            | 36 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-86409.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-86409.patch b/meta/recipes-support/curl/curl/CVE-2026-86409.patch
new file mode 100644
index 0000000000..55a4def13b
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-86409.patch
@@ -0,0 +1,36 @@ 
+From 0d375942119d6a8fe6a4c6874a2f1f05d3312ad0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= <joaomarcos.costa@bootlin.com>
+Date: Thu, 5 Nov 2026 17:55:56 +0100
+Subject: [PATCH] setopt: make NULL CURLOPT_AWS_SIGV4 disable aws-sigv4 auth
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Disable `CURLAUTH_AWS_SIGV4` when `CURLOPT_AWS_SIGV4` is set to NULL.
+Syncing behavior with `CURLAUTH_HTTPSIG`.
+
+Reported-by: Stanislav Fort
+
+Closes #22681
+
+CVE: CVE-2026-86409
+Upstream-Status: Backport [https://github.com/curl/curl/commit/c3c70440e8d9938c0bb732595751e8aebc614f24]
+
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ lib/setopt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 8a5a5d7c33..bcf41807e7 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -693,6 +693,8 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
+      */
+     if(data->set.str[STRING_AWS_SIGV4])
+       data->set.httpauth = CURLAUTH_AWS_SIGV4;
++    else
++      data->set.httpauth &= ~(uint32_t)CURLAUTH_AWS_SIGV4;
+     break;
+ #endif
+ 
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index ab33d4aa77..18123ece3c 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -43,6 +43,7 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-13608.patch \
            file://CVE-2026-8286.patch \
            file://CVE-2026-80230.patch \
+           file://CVE-2026-86409.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \