[rpms/curl] f44: Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse

[Jan Macku <jamacku@redhat.com>]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : 4323d18a8ae8db5a58eb6b2f0c35a21267e0cc05
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-24T12:56:43+02:00
Stats  : +81/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/4323d18a8ae8db5a58eb6b2f0c35a21267e0cc05?branch=f44

Log:
Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse

---
diff --git a/0016-curl-8.18.0-CVE-2026-8286.patch b/0016-curl-8.18.0-CVE-2026-8286.patch
new file mode 100644
index 0000000..2eb0bc9
--- /dev/null
+++ b/0016-curl-8.18.0-CVE-2026-8286.patch
@@ -0,0 +1,77 @@
+From 923ac48aa01d59577211d3fa617acb5a150685ba Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 24 Mar 2026 08:35:08 +0100
+Subject: [PATCH] CVE-2026-8286
+
+url: do not reuse a non-tls starttls connection if new requires TLS
+
+Reported-by: Arkadi Vainbrand
+
+Closes #21082
+
+(cherry picked from commit 507e7be573b0a76fca597b75ff7cb27a66e7d865)
+
+url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+---
+ lib/url.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 5a75fe71da..603fec68b6 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -746,7 +746,11 @@ struct url_conn_match {
+   BIT(want_proxy_ntlm_http);
+   BIT(want_nego_http);
+   BIT(want_proxy_nego_http);
+-
++  BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse
++                 * connections that have matching TLS configuration.
++                 * Always TRUE if `req_tls` is TRUE. */
++  BIT(require_tls); /* Requires TLS use from a clear-text start, can only
++                 * reuse connections that have TLS. */
+   BIT(wait_pipe);
+   BIT(force_reuse);
+   BIT(seen_pending_conn);
+@@ -898,6 +902,9 @@ static bool url_match_ssl_use(struct connectdata *conn,
+        (get_protocol_family(conn->handler) != m->needle->handler->protocol))
+       return FALSE;
+   }
++  else if(m->require_tls)
++    /* a clear-text STARTTLS protocol with required TLS */
++    return FALSE;
+   return TRUE;
+ }
+ 
+@@ -1088,8 +1095,8 @@ static bool url_match_destination(struct connectdata *conn,
+ static bool url_match_ssl_config(struct connectdata *conn,
+                                  struct url_conn_match *m)
+ {
+-  /* If talking TLS, conn needs to use the same SSL options. */
+-  if((m->needle->handler->flags & PROTOPT_SSL) &&
++  /* If talking/upgrading to TLS, conn needs to use the same SSL options. */
++  if(((m->needle->handler->flags & PROTOPT_SSL) || m->may_tls) &&
+      !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {
+     DEBUGF(infof(m->data,
+                  "Connection #%" FMT_OFF_T
+@@ -1360,6 +1367,8 @@ static bool ConnectionExists(struct Curl_easy *data,
+     (needle->handler->protocol & PROTO_FAMILY_HTTP);
+ #endif
+ #endif
++  match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  match.may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+ 
+   /* Find a connection in the pool that matches what "data + needle"
+    * requires. If a suitable candidate is found, it is attached to "data". */
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 94dc738..9c42324 100644
--- a/curl.spec
+++ b/curl.spec
@@ -69,6 +69,9 @@ Patch014: 0014-curl-8.18.0-CVE-2026-11586.patch
 # Fix proto-default skips SSH verification (CVE-2026-12064)
 Patch015: 0015-curl-8.18.0-CVE-2026-12064.patch
 
+# Fix wrong STARTTLS connection reuse (CVE-2026-8286)
+Patch016: 0016-curl-8.18.0-CVE-2026-8286.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -496,6 +499,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)
 - Fix WS Auto-PONG memory exhaustion (CVE-2026-11586)
 - Fix proto-default skips SSH verification (CVE-2026-12064)
+- Fix wrong STARTTLS connection reuse (CVE-2026-8286)
 
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)