[OE-core][wrynose][PATCH 5/8] curl: fix CVE-2026-8458

["Deepak Rathore -X (deeratho - E INFOCHIPS PRIVATE LIMITED at Cisco)" <deeratho@cisco.com>]

From: Deepak Rathore <deeratho@cisco.com>

This patch applies the upstream curl security fix backport for
CVE-2026-8458. The upstream fix commit is referenced in [1],
and the public curl advisory is referenced in [2]. The backported
commit link is also recorded in the embedded patch header.

[1] https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d
[2] https://curl.se/docs/CVE-2026-8458.html

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
---
 .../curl/curl/CVE-2026-8458.patch             | 202 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
 2 files changed, 203 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8458.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8458.patch b/meta/recipes-support/curl/curl/CVE-2026-8458.patch
new file mode 100644
index 0000000000..6340f5305f
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8458.patch
@@ -0,0 +1,202 @@
+From 01ce94b67888e6efa4196247302e59cf68e77b2d Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 13 Jul 2026 23:13:37 -0700
+Subject: [PATCH] creds: add sasl service name
+
+The SASL service name, used in authentication, is part of curl's credentials
+when authenticating to a server/proxy. Make it part of `struct Curl_creds`.
+
+Change code to use `creds` to obtain a service name. By tying creds used
+to the connection, connection reuse is also only allowed when the service
+name matches.
+
+Closes #21585
+
+CVE: CVE-2026-8458
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5e99b73cf441d9c369768b9cd48b5389b9a2503d]
+
+Backport Changes:
+- Wrynose curl 8.19.0 does not have upstream struct Curl_creds.
+  This backport stores the optional SASL service name on the existing
+  connectdata/proxy_info structures and compares it during connection
+  reuse for the same security behavior.
+- Omitted the upstream unit1304 Curl_creds_create() signature
+  adjustment because Wrynose 8.19.0 does not contain Curl_creds.
+
+(cherry picked from commit 5e99b73cf441d9c369768b9cd48b5389b9a2503d)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c     | 61 ++++++++++++++++++++++++++++++++++++++++++++++-----
+ lib/urldata.h |  2 ++
+ 2 files changed, 58 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 6c1375f8e3..35f467daf2 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -535,12 +535,15 @@ void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn)
+   Curl_safefree(conn->socks_proxy.user);
+   Curl_safefree(conn->http_proxy.passwd);
+   Curl_safefree(conn->socks_proxy.passwd);
++  Curl_safefree(conn->http_proxy.sasl_service_name);
++  Curl_safefree(conn->socks_proxy.sasl_service_name);
+   Curl_safefree(conn->http_proxy.host.rawalloc); /* http proxy name buffer */
+   Curl_safefree(conn->socks_proxy.host.rawalloc); /* socks proxy name buffer */
+ #endif
+   Curl_safefree(conn->user);
+   Curl_safefree(conn->passwd);
+   Curl_safefree(conn->sasl_authzid);
++  Curl_safefree(conn->sasl_service_name);
+   Curl_safefree(conn->options);
+   Curl_safefree(conn->oauth_bearer);
+   Curl_safefree(conn->host.rawalloc); /* hostname buffer */
+@@ -593,7 +596,9 @@ static bool proxy_info_matches(const struct proxy_info *data,
+      curl_strequal(data->host.name, needle->host.name)) {
+ 
+     if(Curl_timestrcmp(data->user, needle->user) ||
+-       Curl_timestrcmp(data->passwd, needle->passwd))
++       Curl_timestrcmp(data->passwd, needle->passwd) ||
++       Curl_timestrcmp(data->sasl_service_name,
++                       needle->sasl_service_name))
+       return FALSE;
+     return TRUE;
+   }
+@@ -1035,6 +1040,8 @@ static bool url_match_auth(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+        Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
+        Curl_timestrcmp(m->needle->sasl_authzid, conn->sasl_authzid) ||
++       Curl_timestrcmp(m->needle->sasl_service_name,
++                       conn->sasl_service_name) ||
+        Curl_timestrcmp(m->needle->oauth_bearer, conn->oauth_bearer)) {
+       /* one of them was different */
+       return FALSE;
+@@ -1116,7 +1123,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+      partway through a handshake!) */
+   if(m->want_ntlm_http) {
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+-       Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
++       Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++       Curl_timestrcmp(m->needle->sasl_service_name,
++                       conn->sasl_service_name)) {
+       /* we prefer a credential match, but this is at least a connection
+          that can be reused and "upgraded" to NTLM if it does
+          not have any auth ongoing. */
+@@ -1147,7 +1156,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->http_proxy.user,
+                        conn->http_proxy.user) ||
+        Curl_timestrcmp(m->needle->http_proxy.passwd,
+-                       conn->http_proxy.passwd))
++                       conn->http_proxy.passwd) ||
++       Curl_timestrcmp(m->needle->http_proxy.sasl_service_name,
++                       conn->http_proxy.sasl_service_name))
+       return FALSE;
+   }
+   else if(conn->proxy_ntlm_state != NTLMSTATE_NONE) {
+@@ -1188,7 +1199,9 @@ static bool url_match_auth_nego(struct connectdata *conn,
+      so that we can reuse Negotiate connections if possible. */
+   if(m->want_nego_http) {
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+-       Curl_timestrcmp(m->needle->passwd, conn->passwd))
++       Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++       Curl_timestrcmp(m->needle->sasl_service_name,
++                       conn->sasl_service_name))
+       return FALSE;
+   }
+   else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+@@ -1207,7 +1220,9 @@ static bool url_match_auth_nego(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->http_proxy.user,
+                        conn->http_proxy.user) ||
+        Curl_timestrcmp(m->needle->http_proxy.passwd,
+-                       conn->http_proxy.passwd))
++                       conn->http_proxy.passwd) ||
++       Curl_timestrcmp(m->needle->http_proxy.sasl_service_name,
++                       conn->http_proxy.sasl_service_name))
+       return FALSE;
+   }
+   else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+@@ -3196,6 +3211,11 @@ static void url_conn_reuse_adjust(struct Curl_easy *data,
+     needle->user = NULL;
+     needle->passwd = NULL;
+   }
++  if(needle->sasl_service_name) {
++    curlx_free(conn->sasl_service_name);
++    conn->sasl_service_name = needle->sasl_service_name;
++    needle->sasl_service_name = NULL;
++  }
+ 
+ #ifndef CURL_DISABLE_PROXY
+   conn->bits.proxy_user_passwd = needle->bits.proxy_user_passwd;
+@@ -3214,6 +3234,17 @@ static void url_conn_reuse_adjust(struct Curl_easy *data,
+     needle->http_proxy.passwd = NULL;
+     needle->socks_proxy.passwd = NULL;
+   }
++  if(needle->http_proxy.sasl_service_name ||
++     needle->socks_proxy.sasl_service_name) {
++    curlx_free(conn->http_proxy.sasl_service_name);
++    curlx_free(conn->socks_proxy.sasl_service_name);
++    conn->http_proxy.sasl_service_name =
++      needle->http_proxy.sasl_service_name;
++    conn->socks_proxy.sasl_service_name =
++      needle->socks_proxy.sasl_service_name;
++    needle->http_proxy.sasl_service_name = NULL;
++    needle->socks_proxy.sasl_service_name = NULL;
++  }
+ #endif
+ 
+   /* Finding a connection for reuse in the cpool matches, among other
+@@ -3283,6 +3314,15 @@ static CURLcode url_create_needle(struct Curl_easy *data,
+     }
+   }
+ 
++  if(data->set.str[STRING_SERVICE_NAME]) {
++    needle->sasl_service_name =
++      curlx_strdup(data->set.str[STRING_SERVICE_NAME]);
++    if(!needle->sasl_service_name) {
++      result = CURLE_OUT_OF_MEMORY;
++      goto out;
++    }
++  }
++
+   if(data->set.str[STRING_BEARER]) {
+     needle->oauth_bearer = curlx_strdup(data->set.str[STRING_BEARER]);
+     if(!needle->oauth_bearer) {
+@@ -3310,6 +3350,17 @@ static CURLcode url_create_needle(struct Curl_easy *data,
+   if(result)
+     goto out;
+ 
++  if(data->set.str[STRING_PROXY_SERVICE_NAME]) {
++    result = Curl_setstropt(&needle->http_proxy.sasl_service_name,
++                            data->set.str[STRING_PROXY_SERVICE_NAME]);
++    if(result)
++      goto out;
++    result = Curl_setstropt(&needle->socks_proxy.sasl_service_name,
++                            data->set.str[STRING_PROXY_SERVICE_NAME]);
++    if(result)
++      goto out;
++  }
++
+   /*************************************************************
+    * If the protocol is using SSL and HTTP proxy is used, we set
+    * the tunnel_proxy bit.
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 6c6c83969c..1c369a54f2 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -586,6 +586,7 @@ struct proxy_info {
+   uint8_t proxytype; /* what kind of proxy that is in use */
+   char *user;    /* proxy username string, allocated */
+   char *passwd;  /* proxy password string, allocated */
++  char *sasl_service_name; /* SASL service name, allocated */
+ };
+ 
+ /*
+@@ -628,6 +629,7 @@ struct connectdata {
+   char *passwd;  /* password string, allocated */
+   char *options; /* options string, allocated */
+   char *sasl_authzid;     /* authorization identity string, allocated */
++  char *sasl_service_name; /* SASL service name, allocated */
+   char *oauth_bearer; /* OAUTH2 bearer, allocated */
+   struct curltime created; /* creation time */
+   struct curltime lastused; /* when returned to the connection poolas idle */
+-- 
+2.35.6
diff --git a/meta/recipes-support/curl/curl_8.19.0.bb b/meta/recipes-support/curl/curl_8.19.0.bb
index 994b1cff28..33ccb73eb3 100644
--- a/meta/recipes-support/curl/curl_8.19.0.bb
+++ b/meta/recipes-support/curl/curl_8.19.0.bb
@@ -27,6 +27,7 @@ SRC_URI = " \
     file://CVE-2026-8927.patch \
     file://CVE-2026-8932-dependent.patch \
     file://CVE-2026-8932.patch \
+    file://CVE-2026-8458.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6