From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f44: Resolves: CVE-2026-9545 - exposing HTTP/3 early data Date: Mon, 24 Aug 2026 14:03:17 GMT Message-ID: <178758019712.1.4173379140246528985.rpms-curl-4096dc5bdede@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f44 X-Git-Rev: 4096dc5bdede7ea5edbc35409a3c3751865b763a QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDQKQ29tbWl0IDogNDA5NmRjNWJkZWRlN2VhNWVkYmMzNTQwOWEzYzM3NTE4NjViNzYzYQpB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y NFQxMzozNzo0NSswMjowMApTdGF0cyAgOiArNzIvLTAgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0 dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvY3VybC9jLzQwOTZkYzViZGVkZTdlYTVl ZGJjMzU0MDlhM2MzNzUxODY1Yjc2M2E/YnJhbmNoPWY0NAoKTG9nOgpSZXNvbHZlczogQ1ZFLTIw MjYtOTU0NSAtIGV4cG9zaW5nIEhUVFAvMyBlYXJseSBkYXRhCgotLS0KZGlmZiAtLWdpdCBhLzAw MjAtY3VybC04LjE4LjAtQ1ZFLTIwMjYtOTU0NS5wYXRjaCBiLzAwMjAtY3VybC04LjE4LjAtQ1ZF LTIwMjYtOTU0NS5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi4wNmM3 ZjE0Ci0tLSAvZGV2L251bGwKKysrIGIvMDAyMC1jdXJsLTguMTguMC1DVkUtMjAyNi05NTQ1LnBh dGNoCkBAIC0wLDAgKzEsNjggQEAKK0Zyb20gMDI1MzYyNjg1MzM2OTIxZDEzZTQ4YWNlMWZiZGMz YWVlODA3NDNhOSBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IFN0ZWZhbiBFaXNzaW5n IDxzdGVmYW5AZWlzc2luZy5vcmc+CitEYXRlOiBUaHUsIDIxIE1heSAyMDI2IDE0OjIxOjU5ICsw MjAwCitTdWJqZWN0OiBbUEFUQ0hdIG5ndGNwMjogZmFpbCBoYW5kc2hha2UgZGlyZWN0bHkKKwor V2hlbiBjZXJ0aWZpY2F0ZSB2ZXJpZmljYXRpb24gZmFpbHMsIGVycm9yIG91dCBvZiB0aGUgaGFu ZHNoYWtlCitjYWxsYmFjaywgZm9yY2luZyBuZ3RjcDIgdG8gc3RvcCBwcm9jZXNzaW5nIHRoZSBj b25uZWN0aW9uIGFueSBmdXJ0aGVyLgorCitDbG9zZXMgIzIxNzEyCisKKyhjaGVycnkgcGlja2Vk IGZyb20gY29tbWl0IDdiOTYxM2ZhOWIxYTVlMDQzMDFhMzkyMGVlZjU4ZTgxMzhkYWQwNWUpCist LS0KKyBsaWIvdnF1aWMvY3VybF9uZ3RjcDIuYyB8IDExICsrKysrKysrKystCisgMSBmaWxlIGNo YW5nZWQsIDEwIGluc2VydGlvbnMoKyksIDEgZGVsZXRpb24oLSkKKworZGlmZiAtLWdpdCBhL2xp Yi92cXVpYy9jdXJsX25ndGNwMi5jIGIvbGliL3ZxdWljL2N1cmxfbmd0Y3AyLmMKK2luZGV4IDk3 ZWY5OGI5NzEuLjIzMzI4N2RjN2UgMTAwNjQ0CistLS0gYS9saWIvdnF1aWMvY3VybF9uZ3RjcDIu YworKysrIGIvbGliL3ZxdWljL2N1cmxfbmd0Y3AyLmMKK0BAIC01MDMsNyArNTAzLDcgQEAgc3Rh dGljIGludCBjZl9uZ3RjcDJfaGFuZHNoYWtlX2NvbXBsZXRlZChuZ3RjcDJfY29ubiAqdGNvbm4s IHZvaWQgKnVzZXJfZGF0YSkKKyAgIGRhdGEgPSBDRl9EQVRBX0NVUlJFTlQoY2YpOworICAgREVC VUdBU1NFUlQoZGF0YSk7CisgICBpZighY3R4IHx8ICFkYXRhKQorLSAgICByZXR1cm4gTkdIVFRQ M19FUlJfQ0FMTEJBQ0tfRkFJTFVSRTsKKysgICAgcmV0dXJuIE5HVENQMl9FUlJfQ0FMTEJBQ0tf RkFJTFVSRTsKKyAKKyAgIGN0eC0+aGFuZHNoYWtlX2F0ID0gKkN1cmxfcGdyc19ub3coZGF0YSk7 CisgICBjdHgtPnRsc19oYW5kc2hha2VfY29tcGxldGUgPSBUUlVFOworQEAgLTUxMSw2ICs1MTEs OSBAQCBzdGF0aWMgaW50IGNmX25ndGNwMl9oYW5kc2hha2VfY29tcGxldGVkKG5ndGNwMl9jb25u ICp0Y29ubiwgdm9pZCAqdXNlcl9kYXRhKQorIAorICAgY3R4LT50bHNfdnJmeV9yZXN1bHQgPSBD dXJsX3ZxdWljX3Rsc192ZXJpZnlfcGVlcigmY3R4LT50bHMsIGNmLAorICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBkYXRhLCAmY3R4LT5wZWVyKTsK KysgIGlmKGN0eC0+dGxzX3ZyZnlfcmVzdWx0KQorKyAgICByZXR1cm4gTkdUQ1AyX0VSUl9DQUxM QkFDS19GQUlMVVJFOworKworICNpZm5kZWYgQ1VSTF9ESVNBQkxFX1ZFUkJPU0VfU1RSSU5HUwor ICAgaWYoQ3VybF90cmNfaXNfdmVyYm9zZShkYXRhKSkgeworICAgICBjb25zdCBuZ3RjcDJfdHJh bnNwb3J0X3BhcmFtcyAqcnA7CitAQCAtMTQ0MCw2ICsxNDQzLDggQEAgc3RhdGljIENVUkxjb2Rl IGNmX25ndGNwMl9yZWN2KHN0cnVjdCBDdXJsX2NmaWx0ZXIgKmNmLCBzdHJ1Y3QgQ3VybF9lYXN5 ICpkYXRhLAorIG91dDoKKyAgIHJlc3VsdCA9IEN1cmxfMXN0X2VycihyZXN1bHQsIGNmX3Byb2dy ZXNzX2VncmVzcyhjZiwgZGF0YSwgJnBrdHgpKTsKKyAgIHJlc3VsdCA9IEN1cmxfMXN0X2Vycihy ZXN1bHQsIGNoZWNrX2FuZF9zZXRfZXhwaXJ5KGNmLCBkYXRhLCAmcGt0eCkpOworKyAgaWYoY3R4 LT50bHNfdnJmeV9yZXN1bHQpCisrICAgIHJlc3VsdCA9IGN0eC0+dGxzX3ZyZnlfcmVzdWx0Owor IGRlbmllZDoKKyAgIENVUkxfVFJDX0NGKGRhdGEsIGNmLCAiWyUiIFBSSWQ2NCAiXSBjZl9yZWN2 KGJsZW49JXp1KSAtPiAlZCwgJXp1IiwKKyAgICAgICAgICAgICAgIHN0cmVhbSA/IHN0cmVhbS0+ aWQgOiAtMSwgYmxlbiwgcmVzdWx0LCAqcG5yZWFkKTsKK0BAIC0xNzY3LDYgKzE3NzIsOCBAQCBz dGF0aWMgQ1VSTGNvZGUgY2Zfbmd0Y3AyX3NlbmQoc3RydWN0IEN1cmxfY2ZpbHRlciAqY2YsIHN0 cnVjdCBDdXJsX2Vhc3kgKmRhdGEsCisgCisgb3V0OgorICAgcmVzdWx0ID0gQ3VybF8xc3RfZXJy KHJlc3VsdCwgY2hlY2tfYW5kX3NldF9leHBpcnkoY2YsIGRhdGEsICZwa3R4KSk7CisrICBpZihj dHgtPnRsc192cmZ5X3Jlc3VsdCkKKysgICAgcmVzdWx0ID0gY3R4LT50bHNfdnJmeV9yZXN1bHQ7 CisgZGVuaWVkOgorICAgQ1VSTF9UUkNfQ0YoZGF0YSwgY2YsICJbJSIgUFJJZDY0ICJdIGNmX3Nl bmQobGVuPSV6dSkgLT4gJWQsICV6dSIsCisgICAgICAgICAgICAgICBzdHJlYW0gPyBzdHJlYW0t PmlkIDogLTEsIGxlbiwgcmVzdWx0LCAqcG53cml0dGVuKTsKK0BAIC0yNjk0LDYgKzI3MDEsOCBA QCBzdGF0aWMgQ1VSTGNvZGUgY2Zfbmd0Y3AyX2Nvbm5lY3Qoc3RydWN0IEN1cmxfY2ZpbHRlciAq Y2YsCisgICB9CisgCisgb3V0OgorKyAgaWYoY3R4LT50bHNfdnJmeV9yZXN1bHQpCisrICAgIHJl c3VsdCA9IGN0eC0+dGxzX3ZyZnlfcmVzdWx0OworICAgaWYoY3R4LT5xY29ubiAmJgorICAgICAg KChyZXN1bHQgPT0gQ1VSTEVfUkVDVl9FUlJPUikgfHwgKHJlc3VsdCA9PSBDVVJMRV9TRU5EX0VS Uk9SKSkgJiYKKyAgICAgIG5ndGNwMl9jb25uX2luX2RyYWluaW5nX3BlcmlvZChjdHgtPnFjb25u KSkgeworLS0gCisyLjU1LjAKKwoKZGlmZiAtLWdpdCBhL2N1cmwuc3BlYyBiL2N1cmwuc3BlYwpp bmRleCBhMWE4MWM0Li44ZWNmMDNiIDEwMDY0NAotLS0gYS9jdXJsLnNwZWMKKysrIGIvY3VybC5z cGVjCkBAIC04MSw2ICs4MSw5IEBAIFBhdGNoMDE4OiAwMDE4LWN1cmwtOC4xOC4wLUNWRS0yMDI2 LTg5MjcucGF0Y2gKICMgRml4IHNlbmRpbmcgb2xkIHJlZmVyZXIgKENWRS0yMDI2LTk1NDYpCiBQ YXRjaDAxOTogMDAxOS1jdXJsLTguMTguMC1DVkUtMjAyNi05NTQ2LnBhdGNoCiAKKyMgRml4IGV4 cG9zaW5nIEhUVFAvMyBlYXJseSBkYXRhIChDVkUtMjAyNi05NTQ1KQorUGF0Y2gwMjA6IDAwMjAt Y3VybC04LjE4LjAtQ1ZFLTIwMjYtOTU0NS5wYXRjaAorCiAjIHBhdGNoIG1ha2luZyBsaWJjdXJs IG11bHRpbGliIHJlYWR5CiBQYXRjaDEwMTogMDEwMS1jdXJsLTcuMzIuMC1tdWx0aWxpYi5wYXRj aAogCkBAIC01MTIsNiArNTE1LDcgQEAgcm0gLWYgJHtSUE1fQlVJTERfUk9PVH0le19tYW5kaXJ9 L21hbjEvd2N1cmwuMSoKIC0gRml4IFNBU0wgZG91YmxlLWZyZWUgKENWRS0yMDI2LTg5MjUpCiAt IEZpeCBlbnYtc2V0IGNyb3NzLXByb3h5IERpZ2VzdCBhdXRoIHN0YXRlIGxlYWsgKENWRS0yMDI2 LTg5MjcpCiAtIEZpeCBzZW5kaW5nIG9sZCByZWZlcmVyIChDVkUtMjAyNi05NTQ2KQorLSBGaXgg ZXhwb3NpbmcgSFRUUC8zIGVhcmx5IGRhdGEgKENWRS0yMDI2LTk1NDUpCiAKICogV2VkIEp1bCAy OSAyMDI2IEphbiBNYWNrdSA8amFtYWNrdUByZWRoYXQuY29tPiAtIDguMTguMC04CiAtIEZpeCB0 cmFpbGluZyBkb3QgZG9tYWluIHN1cGVyIGNvb2tpZSAoQ1ZFLTIwMjYtODkyNCkK