[scarthgap,17/19] curl: add annotation for CVE-2026-10536

Message ID	637ce45a66ff7125b98fc126321b31cb0cf6bf0f.1785277157.git.yoann.congal@smile.fr
State	New
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.221.43, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Subject: [OE-core][scarthgap 17/19] curl: add annotation for CVE-2026-10536 Date: Wed, 29 Jul 2026 00:21:52 +0200 Message-ID: <637ce45a66ff7125b98fc126321b31cb0cf6bf0f.1785277157.git.yoann.congal@smile.fr> In-Reply-To: <cover.1785277157.git.yoann.congal@smile.fr> References: <cover.1785277157.git.yoann.congal@smile.fr> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit
Series	[scarthgap,01/19] libsolv: Fix CVE-2026-9149 \| expand [scarthgap,01/19] libsolv: Fix CVE-2026-9149 [scarthgap,02/19] package.bbclass: hardcode emit_pkgdata to run last [scarthgap,03/19] gawk: Fix CVE-2026-40467 [scarthgap,04/19] gawk: Fix CVE-2026-40468 [scarthgap,05/19] gawk: Fix CVE-2026-40469 [scarthgap,06/19] gawk: Fix CVE-2026-40553 [scarthgap,07/19] python3-cryptography: set CVE_PRODUCT [scarthgap,08/19] python3-ply: set CVE_PRODUCT [scarthgap,09/19] python3-pyasn1: set CVE_PRODUCT [scarthgap,10/19] python3-setuptools: Fix CVE-2026-59890 [scarthgap,11/19] vim: Security Fix for CVE-2026-28422 [scarthgap,12/19] vim: Security Fix for CVE-2026-42307 [scarthgap,13/19] vim: Security Fix for CVE-2026-43961 [scarthgap,14/19] vim: Security Fix for CVE-2026-47162 [scarthgap,15/19] vim: Security Fix for CVE-2026-47167 [scarthgap,16/19] sqlite3: fix CVE-2026-11822 and CVE-2026-11824 [scarthgap,17/19] curl: add annotation for CVE-2026-10536 [scarthgap,18/19] cargo-update-recipe-crates: Don't fail for partially empty Cargo.lock [scarthgap,19/19] openssh: set status for CVE-2026-59998

Message ID

637ce45a66ff7125b98fc126321b31cb0cf6bf0f.1785277157.git.yoann.congal@smile.fr

State

New

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Subject: [OE-core][scarthgap 17/19] curl: add annotation for CVE-2026-10536
Date: Wed, 29 Jul 2026 00:21:52 +0200
Message-ID: 
 <637ce45a66ff7125b98fc126321b31cb0cf6bf0f.1785277157.git.yoann.congal@smile.fr>
In-Reply-To: <cover.1785277157.git.yoann.congal@smile.fr>
References: <cover.1785277157.git.yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Series

[scarthgap,01/19] libsolv: Fix CVE-2026-9149 | expand

Commit Message

Yoann Congal July 28, 2026, 10:21 p.m. UTC

From: João Marcos Costa <joaomarcos.costa@bootlin.com>

This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html

and the fix essentially consolidates the fact that HTTP2 stream
dependency is deprecated.

While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not
actually used so the affected part of the code is not compiled. For
instance, in the do_configure logs:

"""
(...)
HTTP2: no (--with-nghttp2, --with-hyper)
(...)
"""

Ignore this CVE unless 'nghttp2' is enabled.

Signed-off-by: João Marcos Costa (Schneider Electric) <joaomarcos.costa@bootlin.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
---
 meta/recipes-support/curl/curl_8.7.1.bb | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 276526f01e5..3e48c58fa78 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -53,6 +53,7 @@  CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on go
 CVE_STATUS[CVE-2025-0725] = "not-applicable-config: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older"
 CVE_STATUS[CVE-2025-5025] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}"
 CVE_STATUS[CVE-2025-10966] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}"
+CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}"
 
 
 inherit autotools pkgconfig binconfig multilib_header ptest

[scarthgap,17/19] curl: add annotation for CVE-2026-10536

Commit Message

Patch