Re: [OE-core] [scarthgap][PATCH] libsoup-2.4: fix CVE-2026-1467

["Yoann Congal" <yoann.congal@smile.fr>]

On Mon Aug 31, 2026 at 11:13 PM CEST, Jason Stasiak via lists.openembedded.org wrote:
> From: Jason Stasiak <jason.stasiak@gmail.com>
>
> Backport fix for CVE-2026-1467 from meta-oe to OE-core.
> Update CVE patch to address a use case where a uri validation
> failure was not handled.
>
> (From meta-oe rev: 07d67228162018f5f619dce7183f85e79293378d)
>
> Signed-off-by: Jason Stasiak <jason.stasiak@gmail.com>
> ---
>  .../libsoup/libsoup-2.4/CVE-2026-1467.patch   | 276 ++++++++++++++++++
>  .../libsoup/libsoup-2.4_2.74.3.bb             |   1 +
>  2 files changed, 277 insertions(+)
>  create mode 100644 meta/recipes-support/libsoup/libsoup-2.4/CVE-2026-1467.patch

Hello,

Sorry I took so much time answering this one. It has some non-trivial
changes from upstream and I pushed its review "for later" for 2 months
now :-/

Since you have another series on libsoup-2.4[0], can you merge this CVE fix
into its next version? ... and also applying the same review as the
series:
* metadata preservation (authorship, subject, ...)
* diff minimisation from upstream patch

[0]: https://lore.kernel.org/all/20261014161209.2227316-1-jason.stasiak@garmin.com/

Thanks!
-- 
Yoann Congal
Smile ECS