Re: [OE-core][wrynose][PATCH 4/6] curl: Security Fix for CVE-2026-80255

["Yoann Congal" <yoann.congal@smile.fr>]

On Wed Sep 9, 2026 at 10:33 PM CEST, Siddharth Doshi via lists.openembedded.org wrote:
> From: Siddharth Doshi <sdoshi@mvista.com>
>
> Picking patch as per [1], and same patch is mentioned in [2]
>
> [1] https://curl.se/docs/CVE-2026-80255.html
> [2] https://security-tracker.debian.org/tracker/CVE-2026-80255
>
> Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
> ---
>  .../curl/curl/CVE-2026-80255.patch            | 106 ++++++++++++++++++
>  meta/recipes-support/curl/curl_8.19.0.bb      |   1 +
>  2 files changed, 107 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-80255.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-80255.patch b/meta/recipes-support/curl/curl/CVE-2026-80255.patch
> new file mode 100644
> index 0000000000..964193bcbd
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-80255.patch
> @@ -0,0 +1,106 @@
> +From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001
> +From: Daniel Stenberg <daniel@haxx.se>
> +Date: Thu, 27 Aug 2026 08:33:30 +0200
> +Subject: [PATCH] cookie: improve TAB handling
> +
> +For entries with a leading tab. Verified in test 2885.
> +
> +Reported-by: Stanislav Fort
> +Closes #22699
> +
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a]
> +CVE: CVE-2026-80255
> +Signed-off-by: Siddharth Doshi <sdoshi@mvista.com>
> +---
> + lib/cookie.c           |  2 +-
> + tests/data/Makefile.am |  1 +
> + tests/data/test2885    | 52 ++++++++++++++++++++++++++++++++++++++++++
> + 3 files changed, 54 insertions(+), 1 deletion(-)
> + create mode 100644 tests/data/test2885

Hello,

I believe this patch is responsible for ptests failures:
  qemux86-64-ptest debian12-vk-8 wrynose completed at 2026-09-14 22:47:23+00:00
  https://autobuilder.yoctoproject.org/valkyrie/?#/builders/73/builds/4557
  qemuarm64-ptest ubuntu2404-vk-arm2 wrynose completed at 2026-09-14 23:24:50+00:00
  https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4530
  qemuriscv64-ptest alma9-vk-2 wrynose completed at 2026-09-15 00:01:40+00:00
  https://autobuilder.yoctoproject.org/valkyrie/?#/builders/56/builds/2408
  qemuarm64-musl-ptest stream10-vk-arm1 wrynose completed at 2026-09-14 22:49:53+00:00
  https://autobuilder.yoctoproject.org/valkyrie/?#/builders/109/builds/1202
  qemux86-64-musl-ptest fedora43-vk-2 wrynose completed at 2026-09-14 22:48:49+00:00
  https://autobuilder.yoctoproject.org/valkyrie/?#/builders/110/builds/1185

Failed ptests:
{'curl': ['1105_-_HTTP_with_cookie_parser_and_header_recording_-_output']}

I could reproduce this locally with 
bitbake core-image-ptest-curl && bitbake core-image-ptest-curl -c testimage

Can you look into this?

In the meantime, I'll keep 1-3,5-6/6 in my branch.

Regards,
-- 
Yoann Congal
Smile ECS