[rpms/curl] f43: Resolves: CVE-2026-8926 - password leak with netrc and user in URL

[rpms/curl] f43: Resolves: CVE-2026-8926 - password leak with netrc and user in URL

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f43
Commit : e08d6793abe55e9a4cd3c63a56525b75e66b3bd7
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-03T14:27:59+02:00
Stats  : +129/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/e08d6793abe55e9a4cd3c63a56525b75e66b3bd7?branch=f43

Log:
Resolves: CVE-2026-8926 - password leak with netrc and user in URL

---
diff --git a/0010-curl-8.15.0-CVE-2026-8926.patch b/0010-curl-8.15.0-CVE-2026-8926.patch
new file mode 100644
index 0000000..d2a3aa1
--- /dev/null
+++ b/0010-curl-8.15.0-CVE-2026-8926.patch
@@ -0,0 +1,125 @@
+From 9fb03b7bb14943c2dc99d0153a922826edd48879 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 3 Aug 2026 12:56:16 +0200
+Subject: [PATCH 3/5] netrc: scanner refactor
+
+Refactor the netrc scanner. Add test case for checking that the last
+matched machine with unmatched login does not return the password as
+success (unit1304).
+
+Closes #21624
+
+(cherry picked from commit 4ae1d7cc2643e4773a136395f12bc02fc6867854)
+---
+ lib/netrc.c           | 15 ++++++++++++++-
+ tests/unit/unit1304.c | 23 ++++++++++++++++++++---
+ 2 files changed, 34 insertions(+), 4 deletions(-)
+
+diff --git a/lib/netrc.c b/lib/netrc.c
+index bf53fc01e1..e0f0340d50 100644
+--- a/lib/netrc.c
++++ b/lib/netrc.c
+@@ -121,6 +121,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+   unsigned char found = 0; /* login + password found bits, as they can come in
+                               any order */
+   bool our_login = FALSE;  /* found our login name */
++  bool login_mismatch = FALSE; /* host matched but login did not */
+   bool done = FALSE;
+   char *netrcbuffer;
+   struct dynbuf token;
+@@ -303,16 +304,23 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+             done = TRUE;
+             break;
+           }
++          if(specific_login && !our_login && (found & FOUND_LOGIN))
++            login_mismatch = TRUE;
+           state = HOSTFOUND;
+           keyword = NONE;
+           found = 0;
++          our_login = FALSE;
+           Curl_safefree(password);
+           if(!specific_login)
+             Curl_safefree(login);
+         }
+         else if(curl_strequal("default", tok)) {
++          if(specific_login && !our_login && (found & FOUND_LOGIN))
++            login_mismatch = TRUE;
+           state = HOSTVALID;
+           retcode = NETRC_OK; /* we did find our host */
++          found = 0;
++          our_login = FALSE;
+           Curl_safefree(password);
+           if(!specific_login)
+             Curl_safefree(login);
+@@ -339,7 +347,12 @@ static NETRCcode parsenetrc(struct store_netrc *store,
+ out:
+   curlx_dyn_free(&token);
+   if(!retcode) {
+-    if(!password && our_login) {
++    if(specific_login && !our_login &&
++       ((found & FOUND_LOGIN) || login_mismatch)) {
++      /* host matched, a login was present but did not match the user */
++      retcode = NETRC_NO_MATCH;
++    }
++    else if(!password && our_login) {
+       /* success without a password, set a blank one */
+       password = strdup("");
+       if(!password)
+diff --git a/tests/unit/unit1304.c b/tests/unit/unit1304.c
+index 0d7f04f9de..e691cadf32 100644
+--- a/tests/unit/unit1304.c
++++ b/tests/unit/unit1304.c
+@@ -61,7 +61,7 @@ static CURLcode test_unit1304(char *arg)
+   Curl_netrc_init(&store);
+   result = Curl_parsenetrc(&store,
+                            "example.com", &login, &password, arg);
+-  fail_unless(result == 0, "Host should have been found");
++  fail_unless(result == 1, "expected no match");
+   abort_unless(password == NULL, "password is not NULL!");
+   Curl_netrc_cleanup(&store);
+ 
+@@ -84,7 +84,7 @@ static CURLcode test_unit1304(char *arg)
+   Curl_netrc_init(&store);
+   result = Curl_parsenetrc(&store,
+                            "example.com", &login, &password, arg);
+-  fail_unless(result == 0, "Host should have been found");
++  fail_unless(result == 1, "expected no match");
+   abort_unless(password == NULL, "password is not NULL!");
+   Curl_netrc_cleanup(&store);
+ 
+@@ -96,7 +96,7 @@ static CURLcode test_unit1304(char *arg)
+   Curl_netrc_init(&store);
+   result = Curl_parsenetrc(&store,
+                            "example.com", &login, &password, arg);
+-  fail_unless(result == 0, "Host should have been found");
++  fail_unless(result == 1, "expected no match");
+   abort_unless(password == NULL, "password is not NULL!");
+   Curl_netrc_cleanup(&store);
+ 
+@@ -173,6 +173,23 @@ static CURLcode test_unit1304(char *arg)
+   fail_unless(strncmp(login, "none", 4) == 0, "login should be 'none'");
+   Curl_netrc_cleanup(&store);
+ 
++  /*
++   * Test for the last host where we do not want to see the password
++   * if the login does not match.
++   */
++  free(password);
++  password = NULL;
++  free(login);
++  login = (char *)CURL_UNCONST("hilarious");
++  Curl_netrc_init(&store);
++  result = Curl_parsenetrc(&store,
++                           "curl.example.com", &login, &password, arg);
++  fail_unless(result == 1, "expect no match");
++  abort_unless(password == NULL, "password must be NULL");
++  Curl_netrc_cleanup(&store);
++
++  login = NULL;
++
+   UNITTEST_END(t1304_stop(&password, &login))
+ }
+ 
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 47785c6..fbc8b53 100644
--- a/curl.spec
+++ b/curl.spec
@@ -43,6 +43,9 @@ Patch008: 0008-curl-8.15.0-CVE-2026-7168.patch
 # fix cross-origin Digest auth state leak (CVE-2026-11856)
 Patch009: 0009-curl-8.15.0-CVE-2026-11856.patch
 
+# fix password leak with netrc and user in URL (CVE-2026-8926)
+Patch010: 0010-curl-8.15.0-CVE-2026-8926.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -445,6 +448,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 * Mon Aug 03 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-8
 - fix cross-proxy Digest auth state leak (CVE-2026-7168)
 - fix cross-origin Digest auth state leak (CVE-2026-11856)
+- fix password leak with netrc and user in URL (CVE-2026-8926)
 
 * Mon May 11 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-7
 - fix Out of bounds read for cookie path (CVE-2025-9086)