[rpms/curl] f44: Resolves: CVE-2026-9547 - SSH improper host validation

[rpms/curl] f44: Resolves: CVE-2026-9547 - SSH improper host validation

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : cfa8636a0a2cf15c50ac39269a459ee0018dc66e
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-07-29T13:19:05+02:00
Stats  : +36/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/cfa8636a0a2cf15c50ac39269a459ee0018dc66e?branch=f44

Log:
Resolves: CVE-2026-9547 - SSH improper host validation

---
diff --git a/0008-curl-8.18.0-CVE-2026-9547.patch b/0008-curl-8.18.0-CVE-2026-9547.patch
new file mode 100644
index 0000000..5b4b6cc
--- /dev/null
+++ b/0008-curl-8.18.0-CVE-2026-9547.patch
@@ -0,0 +1,32 @@
+From 21000729410df2d9ab105a05ee3759b25ede1f1d Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Fri, 22 May 2026 09:48:15 +0200
+Subject: [PATCH 2/2] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
+
+Host key type mismatch from libssh was incorrectly reported as missing,
+causing key callbacks to accept instead of reject.
+
+Reported by: Joshua Rogers (Aisle Research)
+Closes #21724
+
+(cherry picked from commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1)
+---
+ lib/vssh/libssh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+index 3e6cb3a832..199e97bd3f 100644
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -406,6 +406,8 @@ static int myssh_is_known(struct Curl_easy *data, struct ssh_conn *sshc)
+       keymatch = CURLKHMATCH_OK;
+       break;
+     case SSH_KNOWN_HOSTS_OTHER:
++      keymatch = CURLKHMATCH_MISMATCH;
++      break;
+     case SSH_KNOWN_HOSTS_NOT_FOUND:
+     case SSH_KNOWN_HOSTS_UNKNOWN:
+     case SSH_KNOWN_HOSTS_ERROR:
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 81c018b..94c5e3a 100644
--- a/curl.spec
+++ b/curl.spec
@@ -45,6 +45,9 @@ Patch006: 0006-curl-8.18.0-CVE-2026-3805.patch
 # Fix trailing dot domain super cookie (CVE-2026-8924)
 Patch007: 0007-curl-8.18.0-CVE-2026-8924.patch
 
+# Fix SSH improper host validation (CVE-2026-9547)
+Patch008: 0008-curl-8.18.0-CVE-2026-9547.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -470,6 +473,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 %changelog
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)
+- Fix SSH improper host validation (CVE-2026-9547)
 
 * Mon Jul 20 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-7
 - explicitly disable HTTP/3 support in the minimal build