Hi Yoann, Jaipaul,

I’m preparing a six-patch curl CVE fix series for Wrynose. One of the patches addresses CVE-2026-80230 using the same upstream fix and curl 8.19.0 adaptation as Jaipaul’s submission here. The other five patches address additional CVEs.

Would you prefer that I submit the complete series with the overlap noted in the cover letter, or omit the CVE-2026-80230 patch and submit the remaining five based on Jaipaul’s change?

Thanks,
Darsh

On Fri, Oct 16, 2026 at 07:10 PM, Jaipaul Cheernam wrote:

> 
> Backport the upstream fix [1] as mentioned in [2]
> 
> [1] https://github.com/curl/curl/commit/5267ed859d545534d0c21
> [2] https://curl.se/docs/CVE-2026-80230.html
> 
> Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> ---
> Note: SRC_URI indentation is corrected by devtool
> 
> .../curl/curl/CVE-2026-80230.patch | 68 +++++++++++++++++++
> meta/recipes-support/curl/curl_8.19.0.bb | 62 ++++++++---------
> 2 files changed, 99 insertions(+), 31 deletions(-)
> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80230.patch
> 
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80230.patch
> b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
> new file mode 100644
> index 0000000000..5a6bb35986
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80230.patch
> @@ -0,0 +1,68 @@
> +From 7d34e6397166b10600c2ced93f95641d5e7c1575 Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Mon, 24 Aug 2026 23:37:49 +0200
> +Subject: [PATCH] openssl: no server cert is only okay if also not pinned
> +
> +Reported-by: Stanislav Fort
> +Closes #22660
> +
> +CVE: CVE-2026-80230
> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/5267ed859d545534d0c21675a2b70af5a3b6e3ef
> ]
> +
> +Note: CURL_EASY_STR() macro does not exist in 8.19.0, so the pinned()
> +accesses data->set.str[] directly instead.
> +
> +Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
> +---
> + lib/vtls/openssl.c | 26 +++++++++++++++-----------
> + 1 file changed, 15 insertions(+), 11 deletions(-)
> +
> +diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
> +index 1cf357c..cb6fcc4 100644
> +--- a/lib/vtls/openssl.c
> ++++ b/lib/vtls/openssl.c
> +@@ -4607,21 +4607,24 @@ out:
> + return result;
> + }
> +
> +-static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
> +- struct Curl_easy *data,
> +- X509 *server_cert)
> ++static const char *pinned(struct Curl_cfilter *cf,
> ++ struct Curl_easy *data)
> + {
> +- const char *ptr;
> +- CURLcode result = CURLE_OK;
> +-
> + (void)cf;
> ++ return
> + #ifndef CURL_DISABLE_PROXY
> +- ptr = Curl_ssl_cf_is_proxy(cf) ?
> ++ Curl_ssl_cf_is_proxy(cf) ?
> + data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
> +- data->set.str[STRING_SSL_PINNEDPUBLICKEY];
> +-#else
> +- ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
> + #endif
> ++ data->set.str[STRING_SSL_PINNEDPUBLICKEY];
> ++}
> ++
> ++static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf,
> ++ struct Curl_easy *data,
> ++ X509 *server_cert)
> ++{
> ++ CURLcode result = CURLE_OK;
> ++ const char *ptr = pinned(cf, data);
> + if(ptr) {
> + result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr);
> + if(result)
> +@@ -4803,7 +4806,8 @@ CURLcode Curl_ossl_check_peer_cert(struct
> Curl_cfilter *cf,
> + server_cert = SSL_get1_peer_certificate(octx->ssl);
> + if(!server_cert) {
> + /* no verification at all, this maybe acceptable */
> +- if(!(conn_config->verifypeer || conn_config->verifyhost))
> ++ if(!(conn_config->verifypeer || conn_config->verifyhost) &&
> ++ !pinned(cf, data))
> + goto out;
> +
> + failf(data, "SSL: could not get peer certificate");
> diff --git a/meta/recipes-support/curl/curl_8.19.0.bb
> b/meta/recipes-support/curl/curl_8.19.0.bb
> index 0573e08ea4..c2697d6dd8 100644
> --- a/meta/recipes-support/curl/curl_8.19.0.bb
> +++ b/meta/recipes-support/curl/curl_8.19.0.bb
> @@ -9,37 +9,37 @@ SECTION = "console/network"
> LICENSE = "curl"
> LIC_FILES_CHKSUM = "file://COPYING;md5=0515352b285b9c3f66464b135c9c0fdc"
> 
> -SRC_URI = " \
> - https://curl.se/download/ ${BP}.tar.xz \
> - file://run-ptest \
> - file://disable-tests \
> - file://no-test-timeout.patch \
> - file://CVE-2026-6276.patch \
> - file://CVE-2026-5773.patch \
> - file://mbedtls.patch \
> - file://CVE-2026-5545.patch \
> - file://CVE-2026-6253.patch \
> - file://CVE-2026-6429-dependent.patch \
> - file://CVE-2026-6429.patch \
> - file://CVE-2026-7168.patch \
> - file://CVE-2026-4873.patch \
> - file://CVE-2026-8286.patch \
> - file://CVE-2026-8927.patch \
> - file://CVE-2026-8932-dependent.patch \
> - file://CVE-2026-8932.patch \
> - file://CVE-2026-11352.patch \
> - file://CVE-2026-11586.patch \
> - file://CVE-2026-7009.patch \
> - file://CVE-2026-8925.patch \
> - file://CVE-2026-9080.patch \
> - file://CVE-2026-9545-01.patch \
> - file://CVE-2026-9545-02.patch \
> - file://CVE-2026-9079.patch \
> - file://CVE-2026-13608.patch \
> - file://CVE-2026-80229.patch \
> - file://CVE-2026-9546-01.patch \
> - file://CVE-2026-9546-02.patch \
> -"
> +SRC_URI = " https://curl.se/download/ ${BP}.tar.xz \
> + file://run-ptest \
> + file://disable-tests \
> + file://no-test-timeout.patch \
> + file://CVE-2026-6276.patch \
> + file://CVE-2026-5773.patch \
> + file://mbedtls.patch \
> + file://CVE-2026-5545.patch \
> + file://CVE-2026-6253.patch \
> + file://CVE-2026-6429-dependent.patch \
> + file://CVE-2026-6429.patch \
> + file://CVE-2026-7168.patch \
> + file://CVE-2026-4873.patch \
> + file://CVE-2026-8286.patch \
> + file://CVE-2026-8927.patch \
> + file://CVE-2026-8932-dependent.patch \
> + file://CVE-2026-8932.patch \
> + file://CVE-2026-11352.patch \
> + file://CVE-2026-11586.patch \
> + file://CVE-2026-7009.patch \
> + file://CVE-2026-8925.patch \
> + file://CVE-2026-9080.patch \
> + file://CVE-2026-9545-01.patch \
> + file://CVE-2026-9545-02.patch \
> + file://CVE-2026-9079.patch \
> + file://CVE-2026-13608.patch \
> + file://CVE-2026-80229.patch \
> + file://CVE-2026-9546-01.patch \
> + file://CVE-2026-9546-02.patch \
> + file://CVE-2026-80230.patch \
> + "
> 
> SRC_URI:append:class-nativesdk = " \
> file://environment.d-curl.sh \