[rpms/curl] f44: Resolves: CVE-2026-8926 - password leak with netrc and user in URL

[rpms/curl] f44: Resolves: CVE-2026-8926 - password leak with netrc and user in URL

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : b0815da9f9b01814a71976d69721c4803aefc7b8
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-07-30T12:37:05+02:00
Stats  : +129/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/b0815da9f9b01814a71976d69721c4803aefc7b8?branch=f44

Log:
Resolves: CVE-2026-8926 - password leak with netrc and user in URL

---
diff --git a/0009-curl-8.18.0-CVE-2026-8926.patch b/0009-curl-8.18.0-CVE-2026-8926.patch
new file mode 100644
index 0000000..3d488c4
--- /dev/null
+++ b/0009-curl-8.18.0-CVE-2026-8926.patch
@@ -0,0 +1,125 @@
+From 791cd6178164334f2709e14fec4445b41456802d Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Fri, 15 May 2026 11:45:49 +0200
+Subject: [PATCH] netrc: scanner refactor
+
+Refactor the netrc scanner. Add test case for checking that the last
+matched machine with unmatched login does not return the password as
+success (unit1304).
+
+Closes #21624
+
+(cherry picked from commit 4ae1d7cc2643e4773a136395f12bc02fc6867854)
+Co-authored-by: Cursor <cursoragent@cursor.com>
+---
+ lib/netrc.c           | 15 ++++++++++++++-
+ tests/unit/unit1304.c | 22 +++++++++++++++++++---
+ 2 files changed, 33 insertions(+), 4 deletions(-)
+
+diff --git a/lib/netrc.c b/lib/netrc.c
+index 0678733d22..6b5f725054 100644
+--- a/lib/netrc.c
++++ b/lib/netrc.c
+@@ -121,6 +121,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+   unsigned char found = 0; /* login + password found bits, as they can come in
+                               any order */
+   bool our_login = FALSE;  /* found our login name */
++  bool login_mismatch = FALSE; /* host matched but login did not */
+   bool done = FALSE;
+   char *netrcbuffer;
+   struct dynbuf token;
+@@ -303,16 +304,23 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+             done = TRUE;
+             break;
+           }
++          if(specific_login && !our_login && (found & FOUND_LOGIN))
++            login_mismatch = TRUE;
+           state = HOSTFOUND;
+           keyword = NONE;
+           found = 0;
++          our_login = FALSE;
+           Curl_safefree(password);
+           if(!specific_login)
+             Curl_safefree(login);
+         }
+         else if(curl_strequal("default", tok)) {
++          if(specific_login && !our_login && (found & FOUND_LOGIN))
++            login_mismatch = TRUE;
+           state = HOSTVALID;
+           retcode = NETRC_OK; /* we did find our host */
++          found = 0;
++          our_login = FALSE;
+           Curl_safefree(password);
+           if(!specific_login)
+             Curl_safefree(login);
+@@ -339,7 +347,12 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+ out:
+   curlx_dyn_free(&token);
+   if(!retcode) {
+-    if(!password && our_login) {
++    if(specific_login && !our_login &&
++       ((found & FOUND_LOGIN) || login_mismatch)) {
++      /* host matched, a login was present but did not match the user */
++      retcode = NETRC_NO_MATCH;
++    }
++    else if(!password && our_login) {
+       /* success without a password, set a blank one */
+       password = curlx_strdup("");
+       if(!password)
+diff --git a/tests/unit/unit1304.c b/tests/unit/unit1304.c
+index 3438c97104..a7dd8a23d2 100644
+--- a/tests/unit/unit1304.c
++++ b/tests/unit/unit1304.c
+@@ -59,7 +59,7 @@ static CURLcode test_unit1304(const char *arg)
+   login = (char *)CURL_UNCONST("me");
+   Curl_netrc_init(&store);
+   result = Curl_parsenetrc(&store, "example.com", &login, &password, arg);
+-  fail_unless(result == 0, "Host should have been found");
++  fail_unless(result == 1, "expected no match");
+   abort_unless(password == NULL, "password is not NULL!");
+   Curl_netrc_cleanup(&store);
+ 
+@@ -80,7 +80,7 @@ static CURLcode test_unit1304(const char *arg)
+   login = (char *)CURL_UNCONST("admi"); /* spellchecker:disable-line */
+   Curl_netrc_init(&store);
+   result = Curl_parsenetrc(&store, "example.com", &login, &password, arg);
+-  fail_unless(result == 0, "Host should have been found");
++  fail_unless(result == 1, "expected no match");
+   abort_unless(password == NULL, "password is not NULL!");
+   Curl_netrc_cleanup(&store);
+ 
+@@ -91,7 +91,7 @@ static CURLcode test_unit1304(const char *arg)
+   login = (char *)CURL_UNCONST("adminn");
+   Curl_netrc_init(&store);
+   result = Curl_parsenetrc(&store, "example.com", &login, &password, arg);
+-  fail_unless(result == 0, "Host should have been found");
++  fail_unless(result == 1, "expected no match");
+   abort_unless(password == NULL, "password is not NULL!");
+   Curl_netrc_cleanup(&store);
+ 
+@@ -162,6 +162,22 @@ static CURLcode test_unit1304(const char *arg)
+   fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'");
+   Curl_netrc_cleanup(&store);
+ 
++  /*
++   * Test for the last host where we do not want to see the password
++   * if the login does not match.
++   */
++  curlx_free(password);
++  password = NULL;
++  curlx_free(login);
++  login = (char *)CURL_UNCONST("hilarious");
++  Curl_netrc_init(&store);
++  result = Curl_parsenetrc(&store, "curl.example.com", &login, &password, arg);
++  fail_unless(result == 1, "expect no match");
++  abort_unless(password == NULL, "password must be NULL");
++  Curl_netrc_cleanup(&store);
++
++  login = NULL;
++
+   UNITTEST_END(t1304_stop(&password, &login))
+ }
+ 
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 94c5e3a..a9fa385 100644
--- a/curl.spec
+++ b/curl.spec
@@ -48,6 +48,9 @@ Patch007: 0007-curl-8.18.0-CVE-2026-8924.patch
 # Fix SSH improper host validation (CVE-2026-9547)
 Patch008: 0008-curl-8.18.0-CVE-2026-9547.patch
 
+# Fix password leak with netrc and user in URL (CVE-2026-8926)
+Patch009: 0009-curl-8.18.0-CVE-2026-8926.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -474,6 +477,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)
 - Fix SSH improper host validation (CVE-2026-9547)
+- Fix password leak with netrc and user in URL (CVE-2026-8926)
 
 * Mon Jul 20 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-7
 - explicitly disable HTTP/3 support in the minimal build