diff mbox series

[scarthgap,4/7] curl: fix CVE-2026-92386

Message ID 20261106144134.1370928-5-joaomarcos.costa@bootlin.com
State Under Review
Delegated to: Jérémy ROSEN
Headers show
Series curl: fix High scored CVEs | expand

Commit Message

João Marcos Costa (Schneider Electric) Nov. 6, 2026, 2:41 p.m. UTC 
This vulnerability, marked as High [1], was fixed upstream [2] since
v8.23.0.

Backport the fix to curl v8.7.1.

[1] https://nvd.nist.gov/vuln/detail/cve-2026-92386
[2] https://curl.se/docs/CVE-2026-92386.html

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
---
 .../curl/curl/CVE-2026-92386.patch            | 32 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-92386.patch
diff mbox series

Patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-92386.patch b/meta/recipes-support/curl/curl/CVE-2026-92386.patch
new file mode 100644
index 0000000000..9ad6044d8c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-92386.patch
@@ -0,0 +1,32 @@ 
+From a83871b1853ec4fcb514d10d24378b57135b5169 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 16 Sep 2026 11:09:18 +0200
+Subject: [PATCH] cookie: accept slightly longer lines in cookie jars
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Closes #22964
+
+CVE: CVE-2026-92386
+Upstream-Status: Backport [https://github.com/curl/curl/commit/445aa87e13f91c94bc742f54343a2eac924e1765]
+Signed-off-by: João Marcos Costa <joaomarcos.costa@bootlin.com>
+---
+ lib/cookie.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 67494d2855..7f7cd741c9 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1244,7 +1244,9 @@ struct CookieInfo *Curl_cookie_init(struct Curl_easy *data,
+     c->running = FALSE; /* this is not running, this is init */
+     if(fp) {
+       struct dynbuf buf;
+-      Curl_dyn_init(&buf, MAX_COOKIE_LINE);
++      /* accept a little longer lines so that a full cookie fits and does not
++         abort the file read */
++      Curl_dyn_init(&buf, MAX_COOKIE_LINE + 48);
+       while(Curl_get_line(&buf, fp)) {
+         char *lineptr = Curl_dyn_ptr(&buf);
+         bool headerline = FALSE;
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 40de36e151..12db6c0c24 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -46,6 +46,7 @@  SRC_URI = "https://curl.se/download/${BP}.tar.xz \
            file://CVE-2026-86409.patch \
            file://CVE-2026-87864.patch \
            file://CVE-2026-87865.patch \
+           file://CVE-2026-92386.patch \
            "
 
 SRC_URI:append:class-nativesdk = " \