[rpms/curl] f43: Resolves: CVE-2026-9547 - SSH improper host validation

[rpms/curl] f43: Resolves: CVE-2026-9547 - SSH improper host validation

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f43
Commit : 28eabf0249c70efaf2dc7b0d824df817baf0e315
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-03T14:27:59+02:00
Stats  : +36/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/28eabf0249c70efaf2dc7b0d824df817baf0e315?branch=f43

Log:
Resolves: CVE-2026-9547 - SSH improper host validation

---
diff --git a/0011-curl-8.15.0-CVE-2026-9547.patch b/0011-curl-8.15.0-CVE-2026-9547.patch
new file mode 100644
index 0000000..8c063f5
--- /dev/null
+++ b/0011-curl-8.15.0-CVE-2026-9547.patch
@@ -0,0 +1,32 @@
+From fadde9f005855a9e3969e5cf08af16be1ea09153 Mon Sep 17 00:00:00 2001
+From: Joshua Rogers <MegaManSec@users.noreply.github.com>
+Date: Fri, 22 May 2026 09:48:15 +0200
+Subject: [PATCH 4/5] libssh: map SSH_KNOWN_HOSTS_OTHER to CURLKHMATCH_MISMATCH
+
+Host key type mismatch from libssh was incorrectly reported as missing,
+causing key callbacks to accept instead of reject.
+
+Reported by: Joshua Rogers (Aisle Research)
+Closes #21724
+
+(cherry picked from commit 0b8dbbc63c98777e4584cb9fbd71df3464008ad1)
+---
+ lib/vssh/libssh.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/lib/vssh/libssh.c b/lib/vssh/libssh.c
+index 3bae943c7c..11c9c28446 100644
+--- a/lib/vssh/libssh.c
++++ b/lib/vssh/libssh.c
+@@ -423,6 +423,8 @@ static int myssh_is_known(struct Curl_easy *data, struct ssh_conn *sshc)
+       keymatch = CURLKHMATCH_OK;
+       break;
+     case SSH_KNOWN_HOSTS_OTHER:
++      keymatch = CURLKHMATCH_MISMATCH;
++      break;
+     case SSH_KNOWN_HOSTS_NOT_FOUND:
+     case SSH_KNOWN_HOSTS_UNKNOWN:
+     case SSH_KNOWN_HOSTS_ERROR:
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index fbc8b53..140bc49 100644
--- a/curl.spec
+++ b/curl.spec
@@ -46,6 +46,9 @@ Patch009: 0009-curl-8.15.0-CVE-2026-11856.patch
 # fix password leak with netrc and user in URL (CVE-2026-8926)
 Patch010: 0010-curl-8.15.0-CVE-2026-8926.patch
 
+# fix SSH improper host validation (CVE-2026-9547)
+Patch011: 0011-curl-8.15.0-CVE-2026-9547.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -449,6 +452,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - fix cross-proxy Digest auth state leak (CVE-2026-7168)
 - fix cross-origin Digest auth state leak (CVE-2026-11856)
 - fix password leak with netrc and user in URL (CVE-2026-8926)
+- fix SSH improper host validation (CVE-2026-9547)
 
 * Mon May 11 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-7
 - fix Out of bounds read for cookie path (CVE-2025-9086)