[rpms/curl] f44: Resolves: CVE-2026-9546 - sending old referer

[Jan Macku <jamacku@redhat.com>]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : ba160589e760e7f00197e52201489d5e40c83d7a
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-24T13:37:45+02:00
Stats  : +422/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/ba160589e760e7f00197e52201489d5e40c83d7a?branch=f44

Log:
Resolves: CVE-2026-9546 - sending old referer

---
diff --git a/0019-curl-8.18.0-CVE-2026-9546.patch b/0019-curl-8.18.0-CVE-2026-9546.patch
new file mode 100644
index 0000000..33d4b72
--- /dev/null
+++ b/0019-curl-8.18.0-CVE-2026-9546.patch
@@ -0,0 +1,418 @@
+From 64a79efd7cc2f06804b47947edafa69d21ab1fdd Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 15 Apr 2026 08:11:33 +0200
+Subject: [PATCH] CVE-2026-9546
+
+transfer: clear the old autoreferer
+
+Verify in test 2505
+
+Closes #21322
+
+(cherry picked from commit fa057ea3dedb04f93672ec95ee964f1f02ec0ecf)
+
+transfer: clear referer when set to NULL
+
+Verify in test 1649
+
+Closes #21741
+
+(cherry picked from commit 862e8a74a84478d82973471b4f49dc2746c1780e)
+---
+ lib/setopt.c               |  1 -
+ lib/transfer.c             |  7 +++
+ tests/data/Makefile.am     |  3 +-
+ tests/data/test1649        | 55 +++++++++++++++++++++++
+ tests/data/test2505        | 67 ++++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc |  4 +-
+ tests/libtest/lib1649.c    | 90 ++++++++++++++++++++++++++++++++++++++
+ tests/libtest/lib2505.c    | 71 ++++++++++++++++++++++++++++++
+ 8 files changed, 294 insertions(+), 4 deletions(-)
+ create mode 100644 tests/data/test1649
+ create mode 100644 tests/data/test2505
+ create mode 100644 tests/libtest/lib1649.c
+ create mode 100644 tests/libtest/lib2505.c
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 65c573cb9d..a74ca5e8f3 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -1770,7 +1770,6 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
+      * String to set in the HTTP Referer: field.
+      */
+     result = Curl_setstropt(&s->str[STRING_SET_REFERER], ptr);
+-    Curl_bufref_set(&data->state.referer, s->str[STRING_SET_REFERER], 0, NULL);
+     break;
+ 
+   case CURLOPT_USERAGENT:
+diff --git a/lib/transfer.c b/lib/transfer.c
+index fed6a1786e..8050f8a7b1 100644
+--- a/lib/transfer.c
++++ b/lib/transfer.c
+@@ -503,6 +503,13 @@ CURLcode Curl_pretransfer(struct Curl_easy *data)
+   data->state.authproxy.want = data->set.proxyauth;
+   Curl_safefree(data->info.wouldredirect);
+   Curl_data_priority_clear_state(data);
++  if(data->set.http_auto_referer)
++    Curl_bufref_free(&data->state.referer);
++  if(data->set.str[STRING_SET_REFERER])
++    Curl_bufref_set(&data->state.referer, data->set.str[STRING_SET_REFERER],
++                    0, NULL);
++  else
++    Curl_bufref_free(&data->state.referer);
+ 
+   if(data->state.httpreq == HTTPREQ_PUT)
+     data->state.infilesize = data->set.filesize;
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 2a1c87ddc3..e326ff7eff 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -221,6 +221,7 @@ test1614 test1615 test1616 test1617 \
+ test1620 test1621 test1622 \
+ \
+ test1630 test1631 test1632 test1633 test1634 test1635 test1636 \
++test1649 \
+ \
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
+ test1658 \
+@@ -267,7 +268,7 @@ test2309 \
+ \
+ test2400 test2401 test2402 test2403 test2404 test2405 test2406 test2407 \
+ \
+-test2500 test2501 test2502 test2503 \
++test2500 test2501 test2502 test2503 test2505 \
+ \
+ test2600 test2601 test2602 test2603 test2604 test2605 \
+ \
+diff --git a/tests/data/test1649 b/tests/data/test1649
+new file mode 100644
+index 0000000000..d2fd7799bd
+--- /dev/null
++++ b/tests/data/test1649
+@@ -0,0 +1,55 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++Referer
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Content-Length: 6
++
++hello
++</data>
++
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++
++<tool>
++lib%TESTNUMBER
++</tool>
++<name>
++Set referer first then NULL it
++</name>
++<command>
++http://%HOSTIP:%HTTPPORT
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Accept: */*
++Referer: https://secret.example.com/
++
++GET / HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Accept: */*
++
++</protocol>
++
++</verify>
++</testcase>
+diff --git a/tests/data/test2505 b/tests/data/test2505
+new file mode 100644
+index 0000000000..8fac590b37
+--- /dev/null
++++ b/tests/data/test2505
+@@ -0,0 +1,67 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++referer
++autoreferer
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 301 redirect
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: server.example.com
++Content-Length: 47
++Location: %TESTNUMBER0002
++
++file contents should appear once for each file
++</data>
++
++<data2 crlf="headers" nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: server.example.com
++Content-Length: 47
++
++file contents should appear once for each file
++</data2>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++<tool>
++lib%TESTNUMBER
++</tool>
++<name>
++verify CURLOPT_AUTOREFERER switched off
++</name>
++<command>
++http://%HOSTIP:%HTTPPORT
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Accept: */*
++
++GET /%TESTNUMBER0002 HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Accept: */*
++Referer: http://%HOSTIP:%HTTPPORT/
++
++GET / HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 0f8a2ea506..82740ef1b0 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -100,7 +100,7 @@ TESTS_C = \
+   lib1582.c lib1588.c \
+   lib1591.c lib1592.c lib1593.c lib1594.c                     lib1597.c \
+   lib1598.c lib1599.c \
+-  lib1647.c \
++  lib1647.c lib1649.c \
+   lib1662.c \
+   lib1686.c \
+   lib1900.c lib1901.c lib1902.c lib1903.c lib1905.c lib1906.c lib1907.c \
+@@ -115,7 +115,7 @@ TESTS_C = \
+   lib2023.c lib2032.c lib2082.c \
+   lib2301.c lib2302.c lib2304.c           lib2306.c lib2308.c lib2309.c \
+   lib2402.c           lib2404.c lib2405.c \
+-  lib2502.c \
++  lib2502.c lib2505.c \
+   lib2700.c \
+   lib3010.c lib3025.c lib3026.c lib3027.c lib3033.c lib3034.c \
+   lib3100.c lib3101.c lib3102.c lib3103.c lib3104.c lib3105.c \
+diff --git a/tests/libtest/lib1649.c b/tests/libtest/lib1649.c
+new file mode 100644
+index 0000000000..2dd66c0231
+--- /dev/null
++++ b/tests/libtest/lib1649.c
+@@ -0,0 +1,90 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++
++#include "first.h"
++
++/* this is meant to pick up the proxy from the environment variable */
++static CURLcode init1649(CURL *curl, const char *url)
++{
++  CURLcode result = CURLE_OK;
++
++  res_easy_setopt(curl, CURLOPT_URL, url);
++  if(result)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++  if(result)
++    goto init_failed;
++
++  return CURLE_OK; /* success */
++
++init_failed:
++  return result; /* failure */
++}
++
++static CURLcode run1649(CURL *curl, const char *url)
++{
++  CURLcode result = CURLE_OK;
++
++  result = init1649(curl, url);
++  if(result)
++    return result;
++
++  return curl_easy_perform(curl);
++}
++
++static CURLcode test_lib1649(const char *URL)
++{
++  CURLcode result = CURLE_OK;
++  CURL *curl = NULL;
++
++  res_global_init(CURL_GLOBAL_ALL);
++  if(result)
++    return result;
++
++  curl = curl_easy_init();
++  if(!curl) {
++    curl_mfprintf(stderr, "curl_easy_init() failed\n");
++    curl_global_cleanup();
++    return TEST_ERR_MAJOR_BAD;
++  }
++
++  start_test_timing();
++
++  easy_setopt(curl, CURLOPT_REFERER, "https://secret.example.com/");
++
++  result = run1649(curl, URL);
++  if(result)
++    goto test_cleanup;
++
++  /* reset it */
++  easy_setopt(curl, CURLOPT_REFERER, NULL);
++
++  result = run1649(curl, URL);
++
++test_cleanup:
++  curl_easy_cleanup(curl);
++  curl_global_cleanup();
++  return result;
++}
+diff --git a/tests/libtest/lib2505.c b/tests/libtest/lib2505.c
+new file mode 100644
+index 0000000000..c170259874
+--- /dev/null
++++ b/tests/libtest/lib2505.c
+@@ -0,0 +1,71 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Linus Nielsen Feltzing <linus@haxx.se>
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++#include "first.h"
++
++#include "testtrace.h"
++
++static size_t sink2505(char *ptr, size_t size, size_t nmemb, void *ud)
++{
++  (void)ptr;
++  (void)ud;
++  return size * nmemb;
++}
++
++static CURLcode test_lib2505(const char *URL)
++{
++  CURL *curl;
++  CURLcode result = CURLE_OUT_OF_MEMORY;
++
++  if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
++    curl_mfprintf(stderr, "curl_global_init() failed\n");
++    return TEST_ERR_MAJOR_BAD;
++  }
++
++  curl = curl_easy_init();
++  if(!curl) {
++    curl_mfprintf(stderr, "curl_easy_init() failed\n");
++    curl_global_cleanup();
++    return TEST_ERR_MAJOR_BAD;
++  }
++
++  test_setopt(curl, CURLOPT_WRITEFUNCTION, sink2505);
++  test_setopt(curl, CURLOPT_AUTOREFERER, 1L);
++  test_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
++  test_setopt(curl, CURLOPT_URL, URL);
++
++  result = curl_easy_perform(curl);
++  curl_mprintf("req1=%d\n", (int)result);
++
++  test_setopt(curl, CURLOPT_FOLLOWLOCATION, 0L);
++  test_setopt(curl, CURLOPT_URL, URL);
++
++  result = curl_easy_perform(curl);
++  curl_mprintf("req2=%d\n", (int)result);
++
++test_cleanup:
++  curl_easy_cleanup(curl);
++  curl_global_cleanup();
++
++  return result;
++}
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index cb7ef26..a1a81c4 100644
--- a/curl.spec
+++ b/curl.spec
@@ -78,6 +78,9 @@ Patch017: 0017-curl-8.18.0-CVE-2026-8925.patch
 # Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
 Patch018: 0018-curl-8.18.0-CVE-2026-8927.patch
 
+# Fix sending old referer (CVE-2026-9546)
+Patch019: 0019-curl-8.18.0-CVE-2026-9546.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -508,6 +511,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - Fix wrong STARTTLS connection reuse (CVE-2026-8286)
 - Fix SASL double-free (CVE-2026-8925)
 - Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
+- Fix sending old referer (CVE-2026-9546)
 
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)