[rpms/curl] f43: Resolves: CVE-2026-8924 - trailing dot domain super cookie

[rpms/curl] f43: Resolves: CVE-2026-8924 - trailing dot domain super cookie

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f43
Commit : c85981589263d66d9410372cfc0f684b0288ddd5
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-03T14:50:42+02:00
Stats  : +131/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/c85981589263d66d9410372cfc0f684b0288ddd5?branch=f43

Log:
Resolves: CVE-2026-8924 - trailing dot domain super cookie

---
diff --git a/0012-curl-8.15.0-CVE-2026-8924.patch b/0012-curl-8.15.0-CVE-2026-8924.patch
new file mode 100644
index 0000000..8650c00
--- /dev/null
+++ b/0012-curl-8.15.0-CVE-2026-8924.patch
@@ -0,0 +1,127 @@
+From 89f2e2a79823f41f993911a6129704aa8d59d0b1 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 3 Aug 2026 13:00:16 +0200
+Subject: [PATCH 5/5] cookie: trim trailing dots when checking PSL
+
+Verified with test 1629
+
+Closes #21636
+
+(cherry picked from commit 51beed175dbfc37da3113f6acce60c630c070ce8)
+---
+ lib/cookie.c           | 13 +++++++++--
+ tests/data/Makefile.am |  1 +
+ tests/data/test1629    | 61 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 73 insertions(+), 2 deletions(-)
+ create mode 100644 tests/data/test1629
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 2a1e59d9c6..17a6baba0c 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -907,12 +907,21 @@ is_public_suffix(struct Curl_easy *data,
+     char lcookie[256];
+     size_t dlen = strlen(domain);
+     size_t clen = strlen(co->domain);
++
++    /* trim trailing dots */
++    if(dlen && (domain[dlen - 1] == '.'))
++      dlen--;
++    if(clen && (co->domain[clen - 1] == '.'))
++      clen--;
++
+     if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
+       const psl_ctx_t *psl = Curl_psl_use(data);
+       if(psl) {
+         /* the PSL check requires lowercase domain name and pattern */
+-        Curl_strntolower(lcase, domain, dlen + 1);
+-        Curl_strntolower(lcookie, co->domain, clen + 1);
++        Curl_strntolower(lcase, domain, dlen);
++        lcase[dlen] = 0;
++        Curl_strntolower(lcookie, co->domain, clen);
++        lcookie[clen] = 0;
+         acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
+         Curl_psl_release(data);
+       }
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 49684fb735..b789c9f009 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -215,6 +215,7 @@ test1598 test1599 test1600 test1601 test1602 test1603 test1604 test1605 \
+ test1606 test1607 test1608 test1609 test1610 test1611 test1612 test1613 \
+ test1614 test1615 test1616 \
+ test1620 test1621 \
++test1629 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
+ \
+diff --git a/tests/data/test1629 b/tests/data/test1629
+new file mode 100644
+index 0000000000..6ee479ba31
+--- /dev/null
++++ b/tests/data/test1629
+@@ -0,0 +1,61 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 6
++Set-Cookie: something=1; Domain=co.uk.; Path=/
++
++-foo-
++</data>
++
++<datacheck>
++HTTP/1.1 200 OK
++Content-Length: 6
++Set-Cookie: something=1; Domain=co.uk.; Path=/
++
++-foo-
++</datacheck>
++</reply>
++
++# Client-side
++<client>
++<features>
++PSL
++cookies
++</features>
++<server>
++http
++</server>
++<name>
++cookies with trailing dot after PSL domain
++</name>
++<command>
++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: foo.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++GET / HTTP/1.1
++Host: bar.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 140bc49..61a39ee 100644
--- a/curl.spec
+++ b/curl.spec
@@ -49,6 +49,9 @@ Patch010: 0010-curl-8.15.0-CVE-2026-8926.patch
 # fix SSH improper host validation (CVE-2026-9547)
 Patch011: 0011-curl-8.15.0-CVE-2026-9547.patch
 
+# fix trailing dot domain super cookie (CVE-2026-8924)
+Patch012: 0012-curl-8.15.0-CVE-2026-8924.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -453,6 +456,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - fix cross-origin Digest auth state leak (CVE-2026-11856)
 - fix password leak with netrc and user in URL (CVE-2026-8926)
 - fix SSH improper host validation (CVE-2026-9547)
+- fix trailing dot domain super cookie (CVE-2026-8924)
 
 * Mon May 11 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-7
 - fix Out of bounds read for cookie path (CVE-2025-9086)