[rpms/curl] f44: Resolves: CVE-2026-8924 - trailing dot domain super cookie

[rpms/curl] f44: Resolves: CVE-2026-8924 - trailing dot domain super cookie

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : ada9d32d775f9cd1496b108caad210a7f183d23c
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-07-29T13:09:27+02:00
Stats  : +126/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/ada9d32d775f9cd1496b108caad210a7f183d23c?branch=f44

Log:
Resolves: CVE-2026-8924 - trailing dot domain super cookie

---
diff --git a/0007-curl-8.18.0-CVE-2026-8924.patch b/0007-curl-8.18.0-CVE-2026-8924.patch
new file mode 100644
index 0000000..86b06b4
--- /dev/null
+++ b/0007-curl-8.18.0-CVE-2026-8924.patch
@@ -0,0 +1,119 @@
+From 606e40656c37e098cead21670ce1375f0e0ef129 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Sat, 16 May 2026 00:19:09 +0200
+Subject: [PATCH 1/2] cookie: trim trailing dots when checking PSL
+
+Verified with test 1629
+
+Closes #21636
+
+(cherry picked from commit 51beed175dbfc37da3113f6acce60c630c070ce8)
+---
+ lib/cookie.c           | 13 +++++++++--
+ tests/data/Makefile.am |  1 +
+ tests/data/test1629    | 53 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 65 insertions(+), 2 deletions(-)
+ create mode 100644 tests/data/test1629
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index c8072228b9..38edf4a860 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -790,12 +790,21 @@ static bool is_public_suffix(struct Curl_easy *data,
+     char lcookie[256];
+     size_t dlen = strlen(domain);
+     size_t clen = strlen(co->domain);
++
++    /* trim trailing dots */
++    if(dlen && (domain[dlen - 1] == '.'))
++      dlen--;
++    if(clen && (co->domain[clen - 1] == '.'))
++      clen--;
++
+     if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
+       const psl_ctx_t *psl = Curl_psl_use(data);
+       if(psl) {
+         /* the PSL check requires lowercase domain name and pattern */
+-        Curl_strntolower(lcase, domain, dlen + 1);
+-        Curl_strntolower(lcookie, co->domain, clen + 1);
++        Curl_strntolower(lcase, domain, dlen);
++        lcase[dlen] = 0;
++        Curl_strntolower(lcookie, co->domain, clen);
++        lcookie[clen] = 0;
+         acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
+         Curl_psl_release(data);
+       }
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 87977e64aa..bff118240c 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -209,6 +209,7 @@ test1556 test1557 test1558 test1559 test1560 test1561 test1562 test1563 \
+ test1564 test1565 test1566 test1567 test1568 test1569 test1570 test1571 \
+ test1572 test1573 test1574 test1575 test1576 test1577 test1578 test1579 \
+ test1580 test1581 test1582 test1583 test1584 test1585 \
++test1629 \
+ \
+ test1590 test1591 test1592 test1593 test1594 test1595 test1596 test1597 \
+ test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \
+diff --git a/tests/data/test1629 b/tests/data/test1629
+new file mode 100644
+index 0000000000..6ee479ba31
+--- /dev/null
++++ b/tests/data/test1629
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 6
++Set-Cookie: something=1; Domain=co.uk.; Path=/
++
++-foo-
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++PSL
++cookies
++</features>
++<server>
++http
++</server>
++<name>
++cookies with trailing dot after PSL domain
++</name>
++<command>
++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: foo.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++GET / HTTP/1.1
++Host: bar.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 5620c24..81c018b 100644
--- a/curl.spec
+++ b/curl.spec
@@ -12,7 +12,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 8.18.0
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: curl
 Source0: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz
 Source1: https://curl.se/download/%{name}-%{version_no_tilde}.tar.xz.asc
@@ -42,6 +42,9 @@ Patch005: 0005-curl-8.18.0-CVE-2026-3784.patch
 # Fix use after free in SMB connection reuse (CVE-2026-3805)
 Patch006: 0006-curl-8.18.0-CVE-2026-3805.patch
 
+# Fix trailing dot domain super cookie (CVE-2026-8924)
+Patch007: 0007-curl-8.18.0-CVE-2026-8924.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -465,6 +468,9 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
+* Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
+- Fix trailing dot domain super cookie (CVE-2026-8924)
+
 * Mon Jul 20 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-7
 - explicitly disable HTTP/3 support in the minimal build