[OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286

[OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
[2] https://curl.se/docs/CVE-2026-8286.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-8286.patch             | 60 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 61 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
new file mode 100644
index 0000000000..ec2f6165c3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
@@ -0,0 +1,60 @@
+From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+CVE: CVE-2026-8286
+Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
+
+Backport Changes:
+- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream may-TLS
+  and require-TLS distinction in ConnectionExists() and preserve the upstream
+  TLS configuration matching behavior.
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/url.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index dfcd6f4841..9e1ca0336c 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
+   /* plain HTTP with upgrade */
+   bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
+     (needle->handler->protocol & CURLPROTO_HTTP);
+-  bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+
+   *usethis = NULL;
+   *force_reuse = FALSE;
+@@ -1054,7 +1055,7 @@ ConnectionExists(struct Curl_easy *data,
+         continue;
+
+     if(!(needle->handler->flags & PROTOPT_SSL) &&
+-       req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
++       require_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
+       continue;
+
+     if(needle->bits.conn_to_host != check->bits.conn_to_host)
+@@ -1202,8 +1203,8 @@ ConnectionExists(struct Curl_easy *data,
+          needle->remote_port != check->remote_port)
+         continue;
+
+-      /* If talking TLS, check needs to use the same SSL options. */
+-      if((needle->handler->flags & PROTOPT_SSL) &&
++      /* If talking/upgrading to TLS, check needs the same SSL options. */
++      if(((needle->handler->flags & PROTOPT_SSL) || may_tls) &&
+          !Curl_ssl_conn_config_match(data, check, FALSE)) {
+         DEBUGF(infof(data,
+                      "Connection #%" CURL_FORMAT_CURL_OFF_T
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 365f02ad59..c006649a1b 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -41,6 +41,7 @@ SRC_URI = " \
     file://CVE-2026-5545.patch \
     file://CVE-2026-6253.patch \
     file://CVE-2026-4873.patch \
+    file://CVE-2026-8286.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6

[OE-core][scarthgap][PATCH 2/6] curl: Fix CVE-2026-8924

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. Backporting it also protects downstream
configurations that enable libpsl.

[1] https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8
[2] https://curl.se/docs/CVE-2026-8924.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-8924.patch             | 127 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |   1 +
 2 files changed, 128 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8924.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8924.patch b/meta/recipes-support/curl/curl/CVE-2026-8924.patch
new file mode 100644
index 0000000000..9f3ac9ae39
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8924.patch
@@ -0,0 +1,127 @@
+From b9eaedeb9d5440eae886c0b33f4ee48859d7123d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 16 May 2026 00:19:09 +0200
+Subject: [PATCH] cookie: trim trailing dots when checking PSL
+
+Verified with test 1629
+
+Closes #21636
+
+CVE: CVE-2026-8924
+Upstream-Status: Backport [https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8]
+
+Backport Changes:
+- curl 8.7.1 performs the PSL check inline in Curl_cookie_add(). Apply the
+  upstream trailing-dot length normalization at that equivalent code path.
+- Register test1629 in the target-generated Makefile.inc instead of the newer
+  Makefile.am list.
+
+(cherry picked from commit 51beed175dbfc37da3113f6acce60c630c070ce8)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/cookie.c            | 13 ++++++++--
+ tests/data/Makefile.inc |  2 +-
+ tests/data/test1629     | 53 +++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 65 insertions(+), 3 deletions(-)
+ create mode 100644 tests/data/test1629
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 67494d2855..11081e0ba0 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1032,12 +1032,21 @@ Curl_cookie_add(struct Curl_easy *data,
+     char lcookie[256];
+     size_t dlen = strlen(domain);
+     size_t clen = strlen(co->domain);
++
++    /* trim trailing dots */
++    if(dlen && (domain[dlen - 1] == '.'))
++      dlen--;
++    if(clen && (co->domain[clen - 1] == '.'))
++      clen--;
++
+     if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
+       const psl_ctx_t *psl = Curl_psl_use(data);
+       if(psl) {
+         /* the PSL check requires lowercase domain name and pattern */
+-        Curl_strntolower(lcase, domain, dlen + 1);
+-        Curl_strntolower(lcookie, co->domain, clen + 1);
++        Curl_strntolower(lcase, domain, dlen);
++        lcase[dlen] = 0;
++        Curl_strntolower(lcookie, co->domain, clen);
++        lcookie[clen] = 0;
+         acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
+         Curl_psl_release(data);
+       }
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 461eb37b92..9fd47df771 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -207,7 +207,7 @@ test1598 \
+ test1600 test1601 test1602 test1603 test1604 test1605 test1606 test1607 \
+ test1608 test1609 test1610 test1611 test1612 test1613 test1614 test1615 \
+ \
+-test1620 test1621 \
++test1620 test1621 test1629 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
+ \
+diff --git a/tests/data/test1629 b/tests/data/test1629
+new file mode 100644
+index 0000000000..6ee479ba31
+--- /dev/null
++++ b/tests/data/test1629
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 6
++Set-Cookie: something=1; Domain=co.uk.; Path=/
++
++-foo-
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++PSL
++cookies
++</features>
++<server>
++http
++</server>
++<name>
++cookies with trailing dot after PSL domain
++</name>
++<command>
++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: foo.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++GET / HTTP/1.1
++Host: bar.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index c006649a1b..6516c95030 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -42,6 +42,7 @@ SRC_URI = " \
     file://CVE-2026-6253.patch \
     file://CVE-2026-4873.patch \
     file://CVE-2026-8286.patch \
+    file://CVE-2026-8924.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6

[OE-core][scarthgap][PATCH 3/6] curl: Fix CVE-2026-8927

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. The test-only prerequisite uses [3] to provide
positive digest-auth feature detection on curl 8.7.1.

[1] https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567
[2] https://curl.se/docs/CVE-2026-8927.html
[3] https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-8927-dependent.patch   |  41 ++
 .../curl/curl/CVE-2026-8927.patch             | 375 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |   2 +
 3 files changed, 418 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8927.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch b/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
new file mode 100644
index 0000000000..35ff6a9413
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8927-dependent.patch
@@ -0,0 +1,41 @@
+From 9c85f980c3350b59736e4844da34e7f4b726e9c5 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 25 Apr 2025 08:16:13 +0200
+Subject: [PATCH] tests/buildinfo: former "disabled" now provides more info
+
+This tool now contains ON/OFF information about features in the build.
+This way, runtests gets both positive and negative feature presence with
+this. Allows for more flexibility and avoids having to duplicate the
+names.
+
+Closes #17180
+
+CVE: CVE-2026-8927
+Upstream-Status: Backport [https://github.com/curl/curl/commit/1968b32afd8e41fbb87f8911d15c552c6b705385]
+
+Backport Changes:
+- curl 8.7.1 uses the older disabled helper rather than buildinfo. Initialize
+  digest-auth positively in runtests.pl and retain the existing disabled-list
+  pass to clear it when CURL_DISABLE_DIGEST_AUTH is configured.
+- Scope the backport to the digest-auth detection needed by tests 1647 and
+  1686; omit the buildinfo rename and unrelated feature-reporting changes.
+
+(cherry picked from commit 1968b32afd8e41fbb87f8911d15c552c6b705385)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ tests/runtests.pl | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/tests/runtests.pl b/tests/runtests.pl
+index ddfab20e86..b40df554b2 100755
+--- a/tests/runtests.pl
++++ b/tests/runtests.pl
+@@ -637,6 +637,8 @@ sub checksystemfeatures {
+             $feature{"Kerberos"} = $feat =~ /Kerberos/i;
+             # SPNEGO enabled
+             $feature{"SPNEGO"} = $feat =~ /SPNEGO/i;
++            # Digest auth enabled unless disabled by build
++            $feature{"digest-auth"} = 1;
+             # CharConv enabled
+             $feature{"CharConv"} = $feat =~ /CharConv/i;
+             # TLS-SRP enabled
diff --git a/meta/recipes-support/curl/curl/CVE-2026-8927.patch b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
new file mode 100644
index 0000000000..d2bb76e91e
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8927.patch
@@ -0,0 +1,375 @@
+From 66ff71c5c22eed2dfb9c5dbd925e83e37e0d732d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 18 May 2026 23:47:11 +0200
+Subject: [PATCH] url: detect proxy changes read from environment
+
+When a proxy is set from an environment variable, detect if that proxy
+is not the same as previously and flush state.
+
+Verified by test1647: verify changing proxy with env variables and make
+sure Digest state is flushed in the second use
+
+Closes #21666
+
+CVE: CVE-2026-8927
+Upstream-Status: Backport [https://github.com/curl/curl/commit/5c225384b8d52c67ce8259c6e4203bc57aacb567]
+
+Backport Changes:
+- curl 8.7.1 predates the curlx allocation aliases, so the new envproxy state
+  uses the equivalent free() and strdup() calls.
+- curl 8.7.1 frees the parsed proxy string earlier. Keep it alive until the
+  shared cleanup path so the new Digest-state comparison can use it safely.
+- Include vauth/vauth.h explicitly because the target's existing url.c
+  includes do not declare Curl_auth_digest_cleanup().
+- Register test1647 and lib1647 in the target-version Makefile.inc lists,
+  independently of lib1588 from CVE-2026-7168, and adapt the newer libtest
+  entry point to the 8.7.1 test harness.
+- Use the target harness feature names digest-auth and lowercase debug. The
+  preceding test-only dependency backports positive digest-auth detection
+  from curl commit 1968b32afd8e while retaining disabled-build detection.
+
+(cherry picked from commit 5c225384b8d52c67ce8259c6e4203bc57aacb567)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/url.c                  |  13 +++-
+ lib/urldata.h              |   1 +
+ tests/data/Makefile.inc    |   2 +
+ tests/data/test1647        | 103 ++++++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc |   5 ++
+ tests/libtest/lib1647.c    | 124 +++++++++++++++++++++++++++++++++++++
+ 6 files changed, 247 insertions(+), 1 deletion(-)
+ create mode 100644 tests/data/test1647
+ create mode 100644 tests/libtest/lib1647.c
+
+diff --git a/lib/url.c b/lib/url.c
+index 9e1ca0336c..fe7639713a 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -79,6 +79,7 @@
+ #include "share.h"
+ #include "content_encoding.h"
+ #include "http_digest.h"
++#include "vauth/vauth.h"
+ #include "http_negotiate.h"
+ #include "select.h"
+ #include "multiif.h"
+@@ -331,6 +332,9 @@ CURLcode Curl_close(struct Curl_easy **datap)
+   Curl_wildcard_dtor(&data->wildcard);
+   Curl_freeset(data);
+   Curl_headers_cleanup(data);
++#ifndef CURL_DISABLE_DIGEST_AUTH
++  free(data->state.envproxy);
++#endif
+   free(data);
+   return CURLE_OK;
+ }
+@@ -2535,7 +2539,6 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
+     curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype;
+     if(proxy) {
+       result = parse_proxy(data, conn, proxy, ptype);
+-      Curl_safefree(proxy); /* parse_proxy copies the proxy string */
+       if(result)
+         goto out;
+     }
+@@ -2554,6 +2557,14 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
+       result = CURLE_UNSUPPORTED_PROTOCOL;
+       goto out;
+ #else
++#ifndef CURL_DISABLE_DIGEST_AUTH
++      if(!Curl_safecmp(data->state.envproxy, proxy)) {
++        /* proxy changed */
++        Curl_auth_digest_cleanup(&data->state.proxydigest);
++        free(data->state.envproxy);
++        data->state.envproxy = strdup(proxy);
++      }
++#endif
+       /* force this connection's protocol to become HTTP if compatible */
+       if(!(conn->handler->protocol & PROTO_FAMILY_HTTP)) {
+         if((conn->handler->flags & PROTOPT_PROXY_AS_HTTP) &&
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 4fc595a639..d2d9424197 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1247,6 +1247,7 @@ struct UrlState {
+   void (*prev_signal)(int sig);
+ #endif
+ #ifndef CURL_DISABLE_DIGEST_AUTH
++  char *envproxy; /* last proxy string used for proxy-related state */
+   struct digestdata digest;      /* state data for host Digest auth */
+   struct digestdata proxydigest; /* state data for proxy Digest auth */
+ #endif
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 3ec7fa4e21..7452061ea9 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -210,6 +210,8 @@ test1620 test1621 test1629 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
+ \
++test1647 \
++\
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 \
+ test1660 test1661 test1662 \
+ \
+diff --git a/tests/data/test1647 b/tests/data/test1647
+new file mode 100644
+index 0000000000..ecd1cf01c7
+--- /dev/null
++++ b/tests/data/test1647
+@@ -0,0 +1,103 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<connect crlf="headers">
++HTTP/1.1 401 OK
++Content-Length: 21
++Server: no
++
++Denied access. Leave
++</connect>
++
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++https-proxy
++https
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++digest-auth
++debug
++</features>
++<setenv>
++http_proxy=%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPROXYPORT
++CURL_ENTROPY=99376
++</setenv>
++<name>
++HTTP proxy auth Digest, then change proxy with env var and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++
++<proxy crlf="headers">
++CONNECT another.example.com:%HTTPSPORT HTTP/1.1
++Host: another.example.com:%HTTPSPORT
++Proxy-Connection: Keep-Alive
++
++</proxy>
++
++# CONNECT fails
++<errorcode>
++7
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 9d3356aaf5..639d010a00 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -64,6 +64,8 @@ noinst_PROGRAMS = chkhostname libauthretry libntlmconnect libprereq      \
+  lib1558 lib1559 lib1560 lib1564 lib1565 lib1567 lib1568 lib1569 \
+  lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
+  \
++ lib1647 \
++ \
+  lib1662 \
+  \
+  lib1900 \
+@@ -540,6 +542,9 @@ lib1597_LDADD = $(TESTUTIL_LIBS)
+ lib1598_SOURCES = lib1598.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib1598_LDADD = $(TESTUTIL_LIBS)
+
++lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
++lib1647_LDADD = $(TESTUTIL_LIBS)
++
+ lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib1662_LDADD = $(TESTUTIL_LIBS)
+
+diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c
+new file mode 100644
+index 0000000000..2cf4c30da9
+--- /dev/null
++++ b/tests/libtest/lib1647.c
+@@ -0,0 +1,124 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = the first URL
++ * argv2 = URL2
++ * argv3 = credentials 1
++ * argv4 = credentials 2
++ */
++
++#include "test.h"
++#include "testutil.h"
++
++/* this is meant to pick up the proxy from the environment variable */
++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
++{
++  int res = CURLE_OK;
++
++  res_easy_setopt(curl, CURLOPT_URL, url);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++  if(res)
++    goto init_failed;
++
++  return CURLE_OK; /* success */
++
++init_failed:
++  return (CURLcode)res; /* failure */
++}
++
++static CURLcode run1647(CURL *curl, const char *url, const char *userpwd)
++{
++  CURLcode res = CURLE_OK;
++
++  res = init1647(curl, url, userpwd);
++  if(res)
++    return res;
++
++  return curl_easy_perform(curl);
++}
++
++int test(char *URL)
++{
++  int res = CURLE_OK;
++  CURL *curl = NULL;
++
++  if(test_argc < 5)
++    return TEST_ERR_MAJOR_BAD;
++
++  res_global_init(CURL_GLOBAL_ALL);
++  if(res)
++    return res;
++
++  curl = curl_easy_init();
++  if(!curl) {
++    curl_mfprintf(stderr, "curl_easy_init() failed\n");
++    curl_global_cleanup();
++    return TEST_ERR_MAJOR_BAD;
++  }
++
++  start_test_timing();
++
++  curl_mprintf("--- First get '%s'\n", URL);
++  res = run1647(curl, URL, libtest_arg3);
++  if(res)
++    goto test_cleanup;
++
++  curl_mprintf("--- Then get '%s'\n", libtest_arg2);
++  res = run1647(curl, libtest_arg2, test_argv[4]);
++
++test_cleanup:
++
++  /* proper cleanup sequence - type PB */
++
++  curl_easy_cleanup(curl);
++  curl_global_cleanup();
++  return res;
++}
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 6516c95030..f22e69fba4 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -43,6 +43,8 @@ SRC_URI = " \
     file://CVE-2026-4873.patch \
     file://CVE-2026-8286.patch \
     file://CVE-2026-8924.patch \
+    file://CVE-2026-8927-dependent.patch \
+    file://CVE-2026-8927.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6

[OE-core][scarthgap][PATCH 4/6] curl: Fix CVE-2026-8932

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

[1] https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e
[2] https://curl.se/docs/CVE-2026-8932.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-8932.patch             | 342 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |   1 +
 2 files changed, 343 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8932.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-8932.patch b/meta/recipes-support/curl/curl/CVE-2026-8932.patch
new file mode 100644
index 0000000000..c845826cb3
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-8932.patch
@@ -0,0 +1,342 @@
+From fc625fa247f68bc6a44bda391cd8c09bfc5ce5d5 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Tue, 19 May 2026 11:47:50 +0200
+Subject: [PATCH] tls: fix incomplete mTLS config in conn reuse and session
+ cache
+
+cert_type, key, key_type, key_passwd and key_blob lived in
+ssl_config_data but not in ssl_primary_config, so they were invisible to
+match_ssl_primary_config() and to the TLS session cache peer key.
+
+Two easy handles sharing a connection pool could reuse each other's
+authenticated connections when they differed only on SSLKEY, SSLKEYTYPE,
+KEYPASSWD, SSLCERTTYPE or SSLKEYBLOB. The second handle would silently
+inherit the first handle's authenticated identity.
+
+Promote all five fields into ssl_primary_config so the conn-reuse
+predicate and session cache key cover the complete client credential
+set. Also replace the fixed ":CCERT" session cache marker with the
+actual clientcert path so sessions are not shared across different
+client certificates.
+
+Verified by test 3303 and 3304
+
+Reported-By: Joshua Rogers (AISLE Research)
+Closes #21667
+
+CVE: CVE-2026-8932
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7541ae569d82fb308a5e2d94916027da4fa3ba3e]
+
+Backport Changes:
+- curl 8.7.1 keeps the session cache in vtls.c and stores backend key properties
+  outside ssl_primary_config. Duplicate those pointers into the primary
+  configuration so the upstream match, clone, and free behavior covers
+  connection and session reuse without moving every backend access.
+- Omitted backend-only field-access moves in ldap.c, vssh/, and vtls backends
+  because the target keeps the original ssl_config_data members as aliases.
+- Adapt unit3303 to the target curlcheck and test-data harnesses and allocation
+  helpers, and extend it with unit3304's case-insensitive cert_type/key_type
+  checks.
+- Omit newer vtls_scache.c/vtls_scache.h and unit3304 because their peer-key
+  API does not exist in 8.7.1. The target session cache instead uses the clone
+  and match functions in vtls.c, which the adapted unit3303 exercises.
+
+(cherry picked from commit 7541ae569d82fb308a5e2d94916027da4fa3ba3e)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/urldata.h           |   5 ++
+ lib/vtls/vtls.c         |  25 ++++++++
+ tests/data/Makefile.inc |   3 +-
+ tests/data/test3303     |  23 ++++++++
+ tests/unit/Makefile.inc |   4 +-
+ tests/unit/unit3303.c   | 127 ++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 185 insertions(+), 2 deletions(-)
+ create mode 100644 tests/data/test3303
+ create mode 100644 tests/unit/unit3303.c
+
+diff --git a/lib/urldata.h b/lib/urldata.h
+index d2d9424197..9015515e17 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -286,6 +286,11 @@ struct ssl_primary_config {
+   char *CAfile;          /* certificate to verify peer against */
+   char *issuercert;      /* optional issuer certificate filename */
+   char *clientcert;
++  char *cert_type;       /* format for certificate (default: PEM) */
++  char *key;             /* private key file name */
++  struct curl_blob *key_blob;
++  char *key_type;        /* format for private key (default: PEM) */
++  char *key_passwd;      /* plain text private key password */
+   char *cipher_list;     /* list of ciphers to use */
+   char *cipher_list13;   /* list of TLS 1.3 cipher suites to use */
+   char *pinned_key;
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index d13a3cb1b7..c89e8abcc6 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -187,10 +187,15 @@ match_ssl_primary_config(struct Curl_easy *data,
+      blobcmp(c1->cert_blob, c2->cert_blob) &&
+      blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
+      blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
++     blobcmp(c1->key_blob, c2->key_blob) &&
+      Curl_safecmp(c1->CApath, c2->CApath) &&
+      Curl_safecmp(c1->CAfile, c2->CAfile) &&
+      Curl_safecmp(c1->issuercert, c2->issuercert) &&
+      Curl_safecmp(c1->clientcert, c2->clientcert) &&
++     curl_strequal(c1->cert_type, c2->cert_type) &&
++     Curl_safecmp(c1->key, c2->key) &&
++     curl_strequal(c1->key_type, c2->key_type) &&
++     !Curl_timestrcmp(c1->key_passwd, c2->key_passwd) &&
+ #ifdef USE_TLS_SRP
+      !Curl_timestrcmp(c1->username, c2->username) &&
+      !Curl_timestrcmp(c1->password, c2->password) &&
+@@ -234,10 +239,15 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
+   CLONE_BLOB(cert_blob);
+   CLONE_BLOB(ca_info_blob);
+   CLONE_BLOB(issuercert_blob);
++  CLONE_BLOB(key_blob);
+   CLONE_STRING(CApath);
+   CLONE_STRING(CAfile);
+   CLONE_STRING(issuercert);
+   CLONE_STRING(clientcert);
++  CLONE_STRING(cert_type);
++  CLONE_STRING(key);
++  CLONE_STRING(key_type);
++  CLONE_STRING(key_passwd);
+   CLONE_STRING(cipher_list);
+   CLONE_STRING(cipher_list13);
+   CLONE_STRING(pinned_key);
+@@ -257,12 +267,17 @@ static void Curl_free_primary_ssl_config(struct ssl_primary_config *sslc)
+   Curl_safefree(sslc->CAfile);
+   Curl_safefree(sslc->issuercert);
+   Curl_safefree(sslc->clientcert);
++  Curl_safefree(sslc->cert_type);
++  Curl_safefree(sslc->key);
++  Curl_safefree(sslc->key_type);
++  Curl_safefree(sslc->key_passwd);
+   Curl_safefree(sslc->cipher_list);
+   Curl_safefree(sslc->cipher_list13);
+   Curl_safefree(sslc->pinned_key);
+   Curl_safefree(sslc->cert_blob);
+   Curl_safefree(sslc->ca_info_blob);
+   Curl_safefree(sslc->issuercert_blob);
++  Curl_safefree(sslc->key_blob);
+   Curl_safefree(sslc->curves);
+   Curl_safefree(sslc->CRLfile);
+ #ifdef USE_TLS_SRP
+@@ -297,6 +312,11 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+   data->set.ssl.key_passwd = data->set.str[STRING_KEY_PASSWD];
+   data->set.ssl.primary.clientcert = data->set.str[STRING_CERT];
+   data->set.ssl.key_blob = data->set.blobs[BLOB_KEY];
++  data->set.ssl.primary.cert_type = data->set.ssl.cert_type;
++  data->set.ssl.primary.key = data->set.ssl.key;
++  data->set.ssl.primary.key_type = data->set.ssl.key_type;
++  data->set.ssl.primary.key_passwd = data->set.ssl.key_passwd;
++  data->set.ssl.primary.key_blob = data->set.ssl.key_blob;
+
+ #ifndef CURL_DISABLE_PROXY
+   data->set.proxy_ssl.primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
+@@ -322,6 +342,11 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+   data->set.proxy_ssl.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
+   data->set.proxy_ssl.primary.clientcert = data->set.str[STRING_CERT_PROXY];
+   data->set.proxy_ssl.key_blob = data->set.blobs[BLOB_KEY_PROXY];
++  data->set.proxy_ssl.primary.cert_type = data->set.proxy_ssl.cert_type;
++  data->set.proxy_ssl.primary.key = data->set.proxy_ssl.key;
++  data->set.proxy_ssl.primary.key_type = data->set.proxy_ssl.key_type;
++  data->set.proxy_ssl.primary.key_passwd = data->set.proxy_ssl.key_passwd;
++  data->set.proxy_ssl.primary.key_blob = data->set.proxy_ssl.key_blob;
+ #ifdef USE_TLS_SRP
+   data->set.proxy_ssl.primary.username =
+     data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index b68e6b4562..02189d8cc6 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -265,4 +265,5 @@ test3024 test3025 test3026 test3027 test3028 test3029 test3030 \
+ \
+ test3100 test3101 test3102 test3103 \
+ test3200 \
+-test3201 test3202
++test3201 test3202 \
++test3303
+diff --git a/tests/data/test3303 b/tests/data/test3303
+new file mode 100644
+index 0000000000..9b52bcb817
+--- /dev/null
++++ b/tests/data/test3303
+@@ -0,0 +1,23 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++unittest
++TLS
++mTLS
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++none
++</server>
++<features>
++unittest
++</features>
++<name>
++conn-reuse match distinguishes mTLS key, cert_type, key_type and key_passwd fields
++</name>
++</client>
++</testcase>
+diff --git a/tests/unit/Makefile.inc b/tests/unit/Makefile.inc
+index 1926b49b3a..afbe29d2b7 100644
+--- a/tests/unit/Makefile.inc
++++ b/tests/unit/Makefile.inc
+@@ -39,7 +39,7 @@ UNITPROGS = unit1300          unit1302 unit1303 unit1304 unit1305 unit1307 \
+  unit1650 unit1651 unit1652 unit1653 unit1654 unit1655 unit1656 \
+  unit1660 unit1661 \
+  unit2600 unit2601 unit2602 unit2603 \
+- unit3200
++ unit3200 unit3303
+
+ unit1300_SOURCES = unit1300.c $(UNITFILES)
+
+@@ -134,3 +134,5 @@ unit2602_SOURCES = unit2602.c $(UNITFILES)
+ unit2603_SOURCES = unit2603.c $(UNITFILES)
+
+ unit3200_SOURCES = unit3200.c $(UNITFILES)
++
++unit3303_SOURCES = unit3303.c $(UNITFILES)
+diff --git a/tests/unit/unit3303.c b/tests/unit/unit3303.c
+new file mode 100644
+index 0000000000..060a9361fc
+--- /dev/null
++++ b/tests/unit/unit3303.c
+@@ -0,0 +1,127 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "curlcheck.h"
++#include "urldata.h"
++
++#ifdef USE_SSL
++#include "vtls/vtls.h"
++#endif
++
++static CURLcode unit_setup(void)
++{
++  return curl_global_init(CURL_GLOBAL_ALL);
++}
++
++static void unit_stop(void)
++{
++  curl_global_cleanup();
++}
++
++UNITTEST_START
++#ifdef USE_SSL
++{
++  CURL *curl;
++  struct connectdata *conn;
++  struct ssl_primary_config *primary;
++  char *saved;
++  static char alt_passwd[] = "wrong";
++  static char alt_key[] = "other.key";
++  static char alt_ktype[] = "DER";
++  static char alt_ctype[] = "P12";
++  static char lc_ctype[] = "pem";
++  static char lc_ktype[] = "pem";
++
++  curl = curl_easy_init();
++  abort_unless(curl, "curl_easy_init failed");
++
++  curl_easy_setopt(curl, CURLOPT_SSLCERT, "client.pem");
++  curl_easy_setopt(curl, CURLOPT_SSLKEY, "client.key");
++  curl_easy_setopt(curl, CURLOPT_KEYPASSWD, "secret");
++  curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
++  curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, "PEM");
++
++  abort_unless(!Curl_ssl_easy_config_complete((struct Curl_easy *)curl),
++               "Curl_ssl_easy_config_complete failed");
++
++  conn = calloc(1, sizeof(*conn));
++  abort_unless(conn, "connection allocation failed");
++  abort_unless(!Curl_ssl_conn_config_init((struct Curl_easy *)curl, conn),
++               "Curl_ssl_conn_config_init failed");
++
++  fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                         FALSE),
++              "identical mTLS config should match");
++
++  primary = &((struct Curl_easy *)curl)->set.ssl.primary;
++
++  saved = primary->key_passwd;
++  primary->key_passwd = alt_passwd;
++  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                          FALSE),
++              "different key_passwd must not reuse conn");
++  primary->key_passwd = saved;
++
++  saved = primary->key;
++  primary->key = alt_key;
++  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                          FALSE),
++              "different key must not reuse conn");
++  primary->key = saved;
++
++  saved = primary->key_type;
++  primary->key_type = alt_ktype;
++  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                          FALSE),
++              "different key_type must not reuse conn");
++  primary->key_type = saved;
++
++  saved = primary->cert_type;
++  primary->cert_type = alt_ctype;
++  fail_unless(!Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                          FALSE),
++              "different cert_type must not reuse conn");
++  primary->cert_type = saved;
++
++  primary->cert_type = lc_ctype;
++  fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                         FALSE),
++              "cert_type comparison must be case-insensitive");
++  primary->cert_type = saved;
++
++  primary->key_type = lc_ktype;
++  fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                         FALSE),
++              "key_type comparison must be case-insensitive");
++  primary->key_type = saved;
++
++  fail_unless(Curl_ssl_conn_config_match((struct Curl_easy *)curl, conn,
++                                         FALSE),
++              "restored mTLS config should match");
++
++  Curl_ssl_conn_config_cleanup(conn);
++  free(conn);
++  curl_easy_cleanup(curl);
++}
++#endif /* USE_SSL */
++UNITTEST_STOP
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index f22e69fba4..6a2c44365b 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -45,6 +45,7 @@ SRC_URI = " \
     file://CVE-2026-8924.patch \
     file://CVE-2026-8927-dependent.patch \
     file://CVE-2026-8927.patch \
+    file://CVE-2026-8932.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6

[OE-core][scarthgap][PATCH 5/6] curl: Fix CVE-2026-9547

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using
the commit shown in [1]. Backporting it also protects downstream
configurations that enable the libssh backend.

[1] https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1
[2] https://curl.se/docs/CVE-2026-9547.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-9547.patch             | 33 +++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
 2 files changed, 34 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-9547.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-9547.patch b/meta/recipes-support/curl/curl/CVE-2026-9547.patch
new file mode 100644
index 0000000000..992ed21e4c
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-9547.patch
@@ -0,0 +1,33 @@
+From 3f73b2318b9e6358e33519fa49dc3e022aa28c41 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Fri, 22 May 2026 09:48:15 +0200
+Subject: [PATCH] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
+
+Host key type mismatch from libssh was incorrectly reported as missing,
+causing key callbacks to accept instead of reject.
+
+Reported by: Joshua Rogers (Aisle Research)
+Closes #21724
+
+CVE: CVE-2026-9547
+Upstream-Status: Backport [https://github.com/curl/curl/commit/0b8dbbc63c98777e4584cb9fbd71df3464008ad1]
+
+(cherry picked from commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ lib/vssh/libssh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+index 39067a1db6..00dae896bb 100644
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -439,6 +439,8 @@ static int myssh_is_known(struct Curl_easy *data)
+       keymatch = CURLKHMATCH_OK;
+       break;
+     case SSH_KNOWN_HOSTS_OTHER:
++      keymatch = CURLKHMATCH_MISMATCH;
++      break;
+     case SSH_KNOWN_HOSTS_NOT_FOUND:
+     case SSH_KNOWN_HOSTS_UNKNOWN:
+     case SSH_KNOWN_HOSTS_ERROR:
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index 6a2c44365b..e9ba10cb97 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -46,6 +46,7 @@ SRC_URI = " \
     file://CVE-2026-8927-dependent.patch \
     file://CVE-2026-8927.patch \
     file://CVE-2026-8932.patch \
+    file://CVE-2026-9547.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6

[OE-core][scarthgap][PATCH 6/6] curl: Fix CVE-2026-12064

[Devansh Patel -X (devanshp - E INFOCHIPS PRIVATE LIMITED at Cisco)]

From: Devansh Patel <devanshp@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1]. The config2setopts.c change is adapted to curl
8.7.1's equivalent url_proto() implementation in tool_operate.c while
preserving upstream out-of-memory error propagation.

[1] https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e
[2] https://curl.se/docs/CVE-2026-12064.html

Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 .../curl/curl/CVE-2026-12064.patch            | 258 ++++++++++++++++++
 meta/recipes-support/curl/curl_8.7.1.bb       |   1 +
 2 files changed, 259 insertions(+)
 create mode 100644 meta/recipes-support/curl/curl/CVE-2026-12064.patch

diff --git a/meta/recipes-support/curl/curl/CVE-2026-12064.patch b/meta/recipes-support/curl/curl/CVE-2026-12064.patch
new file mode 100644
index 0000000000..4444401864
--- /dev/null
+++ b/meta/recipes-support/curl/curl/CVE-2026-12064.patch
@@ -0,0 +1,258 @@
+From 1bdb3dbcc85bd754b8f5af73159decd926a0b7a4 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Fri, 12 Jun 2026 09:01:22 +0200
+Subject: [PATCH] config2setopts: use default protocol properly
+
+Verified by test 1724, 1725 and 2036
+
+Closes #21983
+
+CVE: CVE-2026-12064
+Upstream-Status: Backport [https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da0418abc279182041e]
+
+Backport Changes:
+- Adapt the config2setopts.c change to curl 8.7.1's equivalent url_proto()
+  implementation in tool_operate.c. Since CURLU_NO_GUESS_SCHEME is not
+  available, parse without scheme guessing when --proto-default is set and
+  use the configured default only when the URL has no explicit scheme.
+- Preserve upstream error handling by propagating CURLUE_OUT_OF_MEMORY from
+  both curl_url_set() and curl_url_get() as CURLE_OUT_OF_MEMORY.
+- Register the regression tests in the target Makefile.inc. Renumber upstream
+  test2036 to test1726 because test2036 already exists in curl 8.7.1. Use
+  the target's %SSH_PWD substitution in test1725. Declare the no-server
+  test1726 explicitly because the older test harness requires it.
+
+(cherry picked from commit ab3bb8cd8be8f9d4acb97da0418abc279182041e)
+Signed-off-by: Devansh Patel <devanshp@cisco.com>
+---
+ docs/cmdline-opts/proto-default.md |  6 +++-
+ src/tool_operate.c                 | 45 +++++++++++++++----------
+ tests/data/Makefile.inc            |  1 +
+ tests/data/test1724                | 53 ++++++++++++++++++++++++++++++
+ tests/data/test1725                | 29 ++++++++++++++++
+ tests/data/test1726                | 29 ++++++++++++++++
+ 6 files changed, 144 insertions(+), 19 deletions(-)
+ create mode 100644 tests/data/test1724
+ create mode 100644 tests/data/test1725
+ create mode 100644 tests/data/test1726
+
+diff --git a/docs/cmdline-opts/proto-default.md b/docs/cmdline-opts/proto-default.md
+index 209e5cdc83..903fac73a5 100644
+--- a/docs/cmdline-opts/proto-default.md
++++ b/docs/cmdline-opts/proto-default.md
+@@ -16,7 +16,8 @@ Example:
+
+ # `--proto-default`
+
+-Use *protocol* for any provided URL missing a scheme.
++Use *protocol* for any provided URL missing a scheme. The case-insensitive
++name should be given without any `://` suffix.
+
+ An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*.
+
+@@ -24,3 +25,6 @@ This option does not change the default proxy protocol (http).
+
+ Without this option set, curl guesses protocol based on the hostname, see
+ --url for details.
++
++The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to
++be used explicitly in the URL.
+diff --git a/src/tool_operate.c b/src/tool_operate.c
+index 7e2c1eefe0..c8059a40d9 100644
+--- a/src/tool_operate.c
++++ b/src/tool_operate.c
+@@ -704,26 +704,35 @@ static CURLcode url_proto(char **url,
+     if(*url) {
+       char *schemep = NULL;
+
+-      if(!curl_url_set(uh, CURLUPART_URL, *url,
+-                       CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) &&
+-         !curl_url_get(uh, CURLUPART_SCHEME, &schemep,
+-                       CURLU_DEFAULT_SCHEME)) {
+-        if(curl_strequal(schemep, proto_ipfs) ||
+-           curl_strequal(schemep, proto_ipns)) {
+-          result = ipfs_url_rewrite(uh, schemep, url, config);
+-          /* short-circuit proto_token, we know it's ipfs or ipns */
+-          if(curl_strequal(schemep, proto_ipfs))
+-            proto = proto_ipfs;
+-          else if(curl_strequal(schemep, proto_ipns))
+-            proto = proto_ipns;
+-          if(result)
+-            config->synthetic_error = TRUE;
++      CURLUcode uc =
++        curl_url_set(uh, CURLUPART_URL, *url,
++                     CURLU_NON_SUPPORT_SCHEME |
++                     (config->proto_default ? 0 : CURLU_GUESS_SCHEME));
++
++      if((uc == CURLUE_BAD_SCHEME) && config->proto_default)
++        proto = proto_token(config->proto_default);
++      else if(!uc) {
++        uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
++                          CURLU_DEFAULT_SCHEME);
++        if(!uc) {
++          if(curl_strequal(schemep, proto_ipfs) ||
++             curl_strequal(schemep, proto_ipns)) {
++            result = ipfs_url_rewrite(uh, schemep, url, config);
++            /* short-circuit proto_token, we know it's ipfs or ipns */
++            if(curl_strequal(schemep, proto_ipfs))
++              proto = proto_ipfs;
++            else if(curl_strequal(schemep, proto_ipns))
++              proto = proto_ipns;
++            if(result)
++              config->synthetic_error = TRUE;
++          }
++          else
++            proto = proto_token(schemep);
+         }
+-        else
+-          proto = proto_token(schemep);
+-
+-        curl_free(schemep);
+       }
++      if(uc == CURLUE_OUT_OF_MEMORY)
++        result = CURLE_OUT_OF_MEMORY;
++      curl_free(schemep);
+     }
+     curl_url_cleanup(uh);
+   }
+diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
+index 9708e37b1f..da87400564 100644
+--- a/tests/data/Makefile.inc
++++ b/tests/data/Makefile.inc
+@@ -220,6 +220,7 @@ test1670 test1671 \
+ test1680 test1681 test1682 test1683 \
+ \
+ test1700 test1701 test1702 test1703 test1704 \
++test1724 test1725 test1726 \
+ \
+ test1800 test1801 \
+ \
+diff --git a/tests/data/test1724 b/tests/data/test1724
+new file mode 100644
+index 0000000000..3cd328e39c
+--- /dev/null
++++ b/tests/data/test1724
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++IPFS
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
++ETag: "21025-dc7-39462498"
++Accept-Ranges: bytes
++Content-Length: 21
++Connection: close
++Content-Type: text/plain
++Funny-head: yesyes
++
++Hello curl from IPFS
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++ipfs
++</features>
++<server>
++http
++</server>
++<name>
++IPFS with --proto-default HTTP
++</name>
++<command>
++--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test1725 b/tests/data/test1725
+new file mode 100644
+index 0000000000..e3b2c5abd2
+--- /dev/null
++++ b/tests/data/test1725
+@@ -0,0 +1,29 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++SCP
++server key check
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++scp
++</server>
++<name>
++SCP incorrect host key with --proto-default SCP
++</name>
++<command>
++--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SSH_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<errorcode>
++60
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test1726 b/tests/data/test1726
+new file mode 100644
+index 0000000000..61f5b5dbd5
+--- /dev/null
++++ b/tests/data/test1726
+@@ -0,0 +1,29 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++--proto-default
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++none
++</server>
++<name>
++Attempt to set a default protocol with :// suffix
++</name>
++<command>
++--proto-default https://
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++# CURLE_UNSUPPORTED_PROTOCOL is error code 1
++<errorcode>
++1
++</errorcode>
++</verify>
++</testcase>
diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb
index e9ba10cb97..267182aacd 100644
--- a/meta/recipes-support/curl/curl_8.7.1.bb
+++ b/meta/recipes-support/curl/curl_8.7.1.bb
@@ -47,6 +47,7 @@ SRC_URI = " \
     file://CVE-2026-8927.patch \
     file://CVE-2026-8932.patch \
     file://CVE-2026-9547.patch \
+    file://CVE-2026-12064.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \
-- 
2.35.6

Re: [OE-core][scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286

[Yoann Congal]

On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via lists.openembedded.org wrote:
> From: Devansh Patel <devanshp@cisco.com>
>
> This patch applies the upstream fix as referenced in [2], using the
> commit shown in [1].
>
> [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
> [2] https://curl.se/docs/CVE-2026-8286.html
>
> Signed-off-by: Devansh Patel <devanshp@cisco.com>
> ---
>  .../curl/curl/CVE-2026-8286.patch             | 60 +++++++++++++++++++
>  meta/recipes-support/curl/curl_8.7.1.bb       |  1 +
>  2 files changed, 61 insertions(+)
>  create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
>
> diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
> new file mode 100644
> index 0000000000..ec2f6165c3
> --- /dev/null
> +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
> @@ -0,0 +1,60 @@
> +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
> +From: Stefan Eissing <stefan@eissing.org>
> +Date: Thu, 7 May 2026 10:30:07 +0200
> +Subject: [PATCH] url: fix connection reuse for starttls protocols
> +
> +When a connection is tested for reuse in a transfer that *may* upgrade
> +to TLS (commonly via STARTTLS), the SSL configuration must match the
> +existing connection.
> +
> +Reported-by: Andrew Nesbit
> +Closes #21522
> +
> +CVE: CVE-2026-8286
> +Upstream-Status: Backport [https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16]
> +
> +Backport Changes:
> +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream may-TLS
> +  and require-TLS distinction in ConnectionExists() and preserve the upstream
> +  TLS configuration matching behavior.
> +
> +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
> +Signed-off-by: Devansh Patel <devanshp@cisco.com>
> +---
> + lib/url.c | 9 +++++----
> + 1 file changed, 5 insertions(+), 4 deletions(-)
> +

Hello,

This patch and the other ones in the series have formating issues:

> +diff --git a/lib/url.c b/lib/url.c
> +index dfcd6f4841..9e1ca0336c 100644
> +--- a/lib/url.c
> ++++ b/lib/url.c
> +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
> +   /* plain HTTP with upgrade */
> +   bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
> +     (needle->handler->protocol & CURLPROTO_HTTP);
> +-  bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
> ++  bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
> ++  bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
> +
   ^ For exemple, here it lacks a space to mark context.

If you use interdiff to compare the upstream patch and yours, it is
quite noticeable.

Can you send a v2 with those fixed?

Thanks!
-- 
Yoann Congal
Smile ECS

Re: [scarthgap][PATCH 1/6] curl: Fix CVE-2026-8286

[Devansh Patel]

[-- Attachment #1: Type: text/plain, Size: 3447 bytes --]

Hi Yoann,

Thanks for the review. I regenerated the patches and also adapted few CVE_STATUSES from Wrynose,
sent a new fresh v1 series combining CVEs with Deepak's two fixes for CVE-2026-6429 & CVE-2026-7168 :

New Series: https://patchwork.yoctoproject.org/project/oe-core/list/?series=51870

The series applies to Scarthgap and curl 8.7.1. Please consider my earlier six-patch series superseded.

Regards,
Devansh

On Fri, Sep 18, 2026 at 03:10 PM, Yoann Congal wrote:

> 
> On Fri Sep 4, 2026 at 11:00 AM CEST, Devansh Patel via
> lists.openembedded.org wrote:
> 
>> From: Devansh Patel <devanshp@cisco.com>
>> 
>> This patch applies the upstream fix as referenced in [2], using the
>> commit shown in [1].
>> 
>> [1] https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
>> 
>> [2] https://curl.se/docs/CVE-2026-8286.html
>> 
>> Signed-off-by: Devansh Patel <devanshp@cisco.com>
>> ---
>> .../curl/curl/CVE-2026-8286.patch | 60 +++++++++++++++++++
>> meta/recipes-support/curl/curl_8.7.1.bb | 1 +
>> 2 files changed, 61 insertions(+)
>> create mode 100644 meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> 
>> diff --git a/meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> new file mode 100644
>> index 0000000000..ec2f6165c3
>> --- /dev/null
>> +++ b/meta/recipes-support/curl/curl/CVE-2026-8286.patch
>> @@ -0,0 +1,60 @@
>> +From 471592386ff977dfd3e2de107b8f81dfc1d3d030 Mon Sep 17 00:00:00 2001
>> +From: Stefan Eissing <stefan@eissing.org>
>> +Date: Thu, 7 May 2026 10:30:07 +0200
>> +Subject: [PATCH] url: fix connection reuse for starttls protocols
>> +
>> +When a connection is tested for reuse in a transfer that *may* upgrade
>> +to TLS (commonly via STARTTLS), the SSL configuration must match the
>> +existing connection.
>> +
>> +Reported-by: Andrew Nesbit
>> +Closes #21522
>> +
>> +CVE: CVE-2026-8286
>> +Upstream-Status: Backport [ https://github.com/curl/curl/commit/a86efdd7ca5433de9231e650f18247de8319ad16
>> ]
>> +
>> +Backport Changes:
>> +- curl 8.7.1 predates the url_conn_match refactor. Carry the upstream
>> may-TLS
>> + and require-TLS distinction in ConnectionExists() and preserve the
>> upstream
>> + TLS configuration matching behavior.
>> +
>> +(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
>> +Signed-off-by: Devansh Patel <devanshp@cisco.com>
>> +---
>> + lib/url.c | 9 +++++----
>> + 1 file changed, 5 insertions(+), 4 deletions(-)
>> +
> 
> Hello,
> 
> This patch and the other ones in the series have formating issues:
> 
> 
>> +diff --git a/lib/url.c b/lib/url.c
>> +index dfcd6f4841..9e1ca0336c 100644
>> +--- a/lib/url.c
>> ++++ b/lib/url.c
>> +@@ -935,7 +935,8 @@ ConnectionExists(struct Curl_easy *data,
>> + /* plain HTTP with upgrade */
>> + bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
>> + (needle->handler->protocol & CURLPROTO_HTTP);
>> +- bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
>> ++ bool require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
>> ++ bool may_tls = data->set.use_ssl > CURLUSESSL_NONE;
>> +
> 
> ^ For exemple, here it lacks a space to mark context.
> 
> If you use interdiff to compare the upstream patch and yours, it is
> quite noticeable.
> 
> Can you send a v2 with those fixed?
> 
> Thanks!
> --
> Yoann Congal
> Smile ECS

[-- Attachment #2: Type: text/html, Size: 4028 bytes --]