[rpms/curl] f44: Resolves: CVE-2026-8925 - SASL double-free

[rpms/curl] f44: Resolves: CVE-2026-8925 - SASL double-free

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : 9d08eb9cd156d6771417570bbf08cf6ea7c0a91d
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-24T12:58:43+02:00
Stats  : +62/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/9d08eb9cd156d6771417570bbf08cf6ea7c0a91d?branch=f44

Log:
Resolves: CVE-2026-8925 - SASL double-free

---
diff --git a/0017-curl-8.18.0-CVE-2026-8925.patch b/0017-curl-8.18.0-CVE-2026-8925.patch
new file mode 100644
index 0000000..4ec1b83
--- /dev/null
+++ b/0017-curl-8.18.0-CVE-2026-8925.patch
@@ -0,0 +1,58 @@
+From c3b833dc0daba1ee9c398410821849815594fb84 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Thu, 14 May 2026 14:35:21 +0200
+Subject: [PATCH] gsasl: fix potential double free
+
+Also:
+- require libgsasl 1.6.0+ (2010-12-14) for a `gsasl_finish()` that
+  handles a NULL argument.
+  Ref: https://gitlab.com/gsasl/gsasl/-/commit/b550032df8488a9ceaa3cfd4c634947d8f219717
+
+Reported-by: Joshua Rogers (Aisle Research)
+
+Closes #21609
+
+(cherry picked from commit 3da249e1f0716c06644ed3522a37a8bf81808012)
+---
+ docs/INTERNALS.md | 1 +
+ lib/vauth/gsasl.c | 5 +++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md
+index 222d9ab5ed..9ddb4ef8ba 100644
+--- a/docs/INTERNALS.md
++++ b/docs/INTERNALS.md
+@@ -28,6 +28,7 @@ versions of libs and build tools.
+  - c-ares       1.6.0 (2008-12-09)
+  - GnuTLS       3.6.5 (2018-12-01)
+  - libidn2      2.0.0 (2017-03-29)
++ - libgsasl     1.6.0 (2010-12-14)
+  - LibreSSL     2.9.1 (2019-04-22)
+  - libssh       0.9.0 (2019-06-28)
+  - libssh2      1.9.0 (2019-06-20)
+diff --git a/lib/vauth/gsasl.c b/lib/vauth/gsasl.c
+index b95d6e3f0a..60f1c56c2c 100644
+--- a/lib/vauth/gsasl.c
++++ b/lib/vauth/gsasl.c
+@@ -32,6 +32,10 @@
+ 
+ #include <gsasl.h>
+ 
++#if GSASL_VERSION_NUMBER < 0x010600
++#error "requires libgsasl 1.6.0+"
++#endif
++
+ bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
+                                   const char *mech,
+                                   struct gsasldata *gsasl)
+@@ -47,6 +51,7 @@ bool Curl_auth_gsasl_is_supported(struct Curl_easy *data,
+   res = gsasl_client_start(gsasl->ctx, mech, &gsasl->client);
+   if(res != GSASL_OK) {
+     gsasl_done(gsasl->ctx);
++    gsasl->ctx = NULL;
+     return FALSE;
+   }
+ 
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 9c42324..dcffdc6 100644
--- a/curl.spec
+++ b/curl.spec
@@ -72,6 +72,9 @@ Patch015: 0015-curl-8.18.0-CVE-2026-12064.patch
 # Fix wrong STARTTLS connection reuse (CVE-2026-8286)
 Patch016: 0016-curl-8.18.0-CVE-2026-8286.patch
 
+# Fix SASL double-free (CVE-2026-8925)
+Patch017: 0017-curl-8.18.0-CVE-2026-8925.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -500,6 +503,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - Fix WS Auto-PONG memory exhaustion (CVE-2026-11586)
 - Fix proto-default skips SSH verification (CVE-2026-12064)
 - Fix wrong STARTTLS connection reuse (CVE-2026-8286)
+- Fix SASL double-free (CVE-2026-8925)
 
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)