Re: [scarthgap][PATCH v3 5/5] curl: fix CVE-2026-7168

["Devansh Patel" <devanshp@cisco.com>]

[-- Attachment #1: Type: text/plain, Size: 1166 bytes --]

Hi Yoann,
I have submitted updated fixes for CVE-2026-6429 and CVE-2026-7168 as patches 7/8 and 8/8 in a complete Scarthgap curl series:

https://patchwork.yoctoproject.org/project/oe-core/list/?series=51870

For CVE-2026-7168, the test prerequisite is separate, the curl 8.7.1 backport changes are explained, and the CURLcode-returning helpers use CURLcode.

Please consider Deepak's v3 4/5 and 5/5 patches superseded and review the new series.

Regards,
Devansh

On Fri, Sep 18, 2026 at 02:51 PM, Yoann Congal wrote:

> 
> On Fri Sep 18, 2026 at 11:19 AM CEST, Yoann Congal wrote:
> 
>> Hello,
>> 
>> This patch conflict with other patches in my branch. Because this one
>> has issues, I will hold it for another cycle, you will have to
>> refresh/rebase on top of the next merge (or send me a new version that
>> applies on top of the -nut branch I will push/test later today)
>> 
>> Details of the issues below:
> 
> I forgot to add that sending partial series (only 4,5/5 and not 1,2/2)
> make my tooling throw warnings... Can you send the patches as 1,2/2 in
> the next iteration?
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

[-- Attachment #2: Type: text/html, Size: 1317 bytes --]