Re: [OE-core] [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467

["Yoann Congal" <yoann.congal@smile.fr>]

On Tue Sep 1, 2026 at 4:35 PM CEST, Jason wrote:
> On Tue, Sep 1, 2026 at 1:32 AM Yoann Congal <yoann.congal@smile.fr> wrote:
>>
>> On Mon Aug 31, 2026 at 11:13 PM CEST, Jason Stasiak via lists.openembedded.org wrote:
>> > From: Jason Stasiak <jason.stasiak@gmail.com>
>> >
>> > Backport fix for CVE-2026-1467 from meta-oe to OE-core.
>> > Update CVE patch to address a use case where a uri validation
>> > failure was not handled.
>> >
>> > (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
>> >
>> > Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
>> > ---
>> >  .../libsoup/libsoup-2.4/CVE-2026-1467.patch   | 276 ++++++++++++++++++
>> >  .../libsoup/libsoup-2.4_2.74.3.bb             |   1 +
>> >  2 files changed, 277 insertions(+)
>> >  create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch
>>
>> Hello,
>>
>> Isn't that the patch Colin McAllister "colin-pm" (CC'd) asked about on
>> IRC #yocto?
>> https://libera.catirclogs.org/yocto/2026-08-28#1787933879-1787935062;
>>
> Yes, I believe that this is the patch he was asking about.
>
>> Is the trouble he mentioned fixed in this version of the patch?
> Yes, the issue has been addressed in the patch and the associated test case in
> the connection tests has been updated to verify the change.

Awesome. I'll put the patch in the review queue.

Thanks!
-- 
Yoann Congal
Smile ECS