[OE-core][wrynose][PATCH] vim: Fix CVE-2026-28417 hostname regression

[OE-core][wrynose][PATCH] vim: Fix CVE-2026-28417 hostname regression

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw
hostname validation. That CVE fix requires follow-up regression patches
because it rejects valid hostnames containing optional ports or
underscores.

Vim 9.2.0340 already contains that CVE fix and patch 9.2.0089, which
corrects optional-port handling. It still needs patch 9.2.0553 to accept
underscores, so backport that commit and retain its _gateway regression
test.

The netrw history hunk is adapted to preserve Wrynose's existing
multi-line history and append the upstream 2026 May 28 entry. The
src/version.c hunk is omitted because this backport does not change the
recipe version or Vim's upstream patch-number table.

[1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1
[2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda
[3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11
[4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../files/CVE-2026-28417-regression_p1.patch  | 64 +++++++++++++++++++
 meta/recipes-support/vim/vim.inc              |  1 +
 2 files changed, 65 insertions(+)
 create mode 100644 meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch

diff --git a/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch
new file mode 100644
index 0000000000..e6b81cc0ae
--- /dev/null
+++ b/meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch
@@ -0,0 +1,64 @@
+From 2a49c9624cdd552ec975ee8b4f1853a0e4c2a78e Mon Sep 17 00:00:00 2001
+From: Christian Brabandt <cb@256bit.org>
+Date: Thu, 28 May 2026 20:53:53 +0000
+Subject: [PATCH] patch 9.2.0553: runtime(netrw): netrw rejects hostnames
+ containing _
+
+Problem:  runtime(netrw): netrw rejects hostnames containing _
+          (lilydjwg)
+Solution: Relax the restriction and allow the underscore
+
+fixes: #20344
+
+CVE: CVE-2026-28417
+Upstream-Status: Backport [https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11]
+
+Backport Changes:
+- Preserved Wrynose's multi-line netrw change history and appended the
+  upstream 2026 May 28 change instead of replacing it with a single date.
+- Omitted src/version.c because this backport does not change the recipe's
+  Vim version or its upstream patch-number table.
+
+Signed-off-by: Christian Brabandt <cb@256bit.org>
+(cherry picked from commit 93d177cd2b69bac58fc51a5a514d7bc71e264b11)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ runtime/pack/dist/opt/netrw/autoload/netrw.vim | 5 +++--
+ src/testdir/test_plugin_netrw.vim              | 1 +
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/runtime/pack/dist/opt/netrw/autoload/netrw.vim b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+index a04120d5f..e64274e70 100644
+--- a/runtime/pack/dist/opt/netrw/autoload/netrw.vim
++++ b/runtime/pack/dist/opt/netrw/autoload/netrw.vim
+@@ -24,6 +24,7 @@
+ " 2026 Mar 01 by Vim Project include portnumber in hostname checking #19533
+ " 2026 Apr 01 by Vim Project use fnameescape() with netrw#FileUrlEdit()
+ " 2026 Apr 05 by Vim Project Fix netrw#RFC2396() #19913
++" 2026 May 28 by Vim Project allow underscores in hostname checking #20344
+ " Copyright:  Copyright (C) 2016 Charles E. Campbell {{{1
+ "             Permission is hereby granted to use and distribute this code,
+ "             with or without modifications, provided that this copyright
+@@ -2603,8 +2604,8 @@ function s:NetrwValidateHostname(hostname)
+   " Username:
+   let user_pat = '\%([a-zA-Z0-9._-]\+@\)\?'
+   " Hostname: 1-64 chars, alphanumeric/dots/hyphens.
+-  " No underscores. No leading/trailing dots/hyphens.
+-  let host_pat = '[a-zA-Z0-9]\%([-a-zA-Z0-9.]\{0,62}[a-zA-Z0-9]\)\?'
++  " No leading/trailing dots/hyphens.
++  let host_pat = '[a-zA-Z0-9_]\%([-a-zA-Z0-9._]\{0,62}[a-zA-Z0-9_]\)\?'
+   " Port: 16 bit unsigned integer
+   let port_pat = '\%(:\d\{1,5\}\)\?$'
+ 
+diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
+index cfce82f68..00dc4e1cb 100644
+--- a/src/testdir/test_plugin_netrw.vim
++++ b/src/testdir/test_plugin_netrw.vim
+@@ -574,6 +574,7 @@ endfunc
+ func Test_netrw_hostname()
+   let valid_hostnames = [
+   \   'localhost',
++  \   '_gateway',
+   \   '127.0.0.1',
+   \   '::1',
+   \   '0:0:0:0:0:0:0:1',
diff --git a/meta/recipes-support/vim/vim.inc b/meta/recipes-support/vim/vim.inc
index 20a5f7a054..ce59e9b539 100644
--- a/meta/recipes-support/vim/vim.inc
+++ b/meta/recipes-support/vim/vim.inc
@@ -29,6 +29,7 @@ SRC_URI = "git://github.com/vim/vim.git;branch=master;protocol=https;tag=v${PV}
            file://CVE-2026-47167.patch \
            file://CVE-2026-55892.patch \
            file://CVE-2026-57452.patch \
+           file://CVE-2026-28417-regression_p1.patch \
            "
 
 PV .= ".0340"
-- 
2.35.6

Re: [wrynose][PATCH] vim: Fix CVE-2026-28417 hostname regression

[Devansh Patel]

[-- Attachment #1: Type: text/plain, Size: 1633 bytes --]

On Wed, Aug 26, 2026 at 11:00 AM, Devansh Patel wrote:

> 
> From: Devansh Patel <devanshp@cisco.com>
> 
> The older Vim patch 9.2.0073 fixed CVE-2026-28417 by tightening netrw
> hostname validation. That CVE fix requires follow-up regression patches
> because it rejects valid hostnames containing optional ports or
> underscores.
> 
> Vim 9.2.0340 already contains that CVE fix and patch 9.2.0089, which
> corrects optional-port handling. It still needs patch 9.2.0553 to accept
> underscores, so backport that commit and retain its _gateway regression
> test.
> 
> The netrw history hunk is adapted to preserve Wrynose's existing
> multi-line history and append the upstream 2026 May 28 entry. The
> src/version.c hunk is omitted because this backport does not change the
> recipe version or Vim's upstream patch-number table.
> 
> [1] https://github.com/vim/vim/commit/79348dbbc09332130f4c86045e1541d68514fcc1
> 
> [2] https://github.com/vim/vim/commit/a6198523fb28a50d96945458792cdb4787d3cdda
> 
> [3] https://github.com/vim/vim/commit/93d177cd2b69bac58fc51a5a514d7bc71e264b11
> 
> [4] https://github.com/vim/vim/security/advisories/GHSA-m3xh-9434-g336
> 
> Signed-off-by: Devansh Patel <devanshp@cisco.com>
> ---
> .../files/CVE-2026-28417-regression_p1.patch | 64 +++++++++++++++++++
> meta/recipes-support/vim/vim.inc | 1 +
> 2 files changed, 65 insertions(+)
> create mode 100644
> meta/recipes-support/vim/files/CVE-2026-28417-regression_p1.patch

Hi Yoann,

Gentle reminder to review the above Vim regression patch when convenient.

Please share your feedback.

Thanks,
Devansh

[-- Attachment #2: Type: text/html, Size: 2395 bytes --]