[rpms/curl] f44: Resolves: CVE-2026-9545 - exposing HTTP/3 early data

[rpms/curl] f44: Resolves: CVE-2026-9545 - exposing HTTP/3 early data

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : 4096dc5bdede7ea5edbc35409a3c3751865b763a
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-24T13:37:45+02:00
Stats  : +72/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/4096dc5bdede7ea5edbc35409a3c3751865b763a?branch=f44

Log:
Resolves: CVE-2026-9545 - exposing HTTP/3 early data

---
diff --git a/0020-curl-8.18.0-CVE-2026-9545.patch b/0020-curl-8.18.0-CVE-2026-9545.patch
new file mode 100644
index 0000000..06c7f14
--- /dev/null
+++ b/0020-curl-8.18.0-CVE-2026-9545.patch
@@ -0,0 +1,68 @@
+From 025362685336921d13e48ace1fbdc3aee80743a9 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 21 May 2026 14:21:59 +0200
+Subject: [PATCH] ngtcp2: fail handshake directly
+
+When certificate verification fails, error out of the handshake
+callback, forcing ngtcp2 to stop processing the connection any further.
+
+Closes #21712
+
+(cherry picked from commit 7b9613fa9b1a5e04301a3920eef58e8138dad05e)
+---
+ lib/vquic/curl_ngtcp2.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c
+index 97ef98b971..233287dc7e 100644
+--- a/lib/vquic/curl_ngtcp2.c
++++ b/lib/vquic/curl_ngtcp2.c
+@@ -503,7 +503,7 @@ static int cf_ngtcp2_handshake_completed(ngtcp2_conn *tconn, void *user_data)
+   data = CF_DATA_CURRENT(cf);
+   DEBUGASSERT(data);
+   if(!ctx || !data)
+-    return NGHTTP3_ERR_CALLBACK_FAILURE;
++    return NGTCP2_ERR_CALLBACK_FAILURE;
+ 
+   ctx->handshake_at = *Curl_pgrs_now(data);
+   ctx->tls_handshake_complete = TRUE;
+@@ -511,6 +511,9 @@ static int cf_ngtcp2_handshake_completed(ngtcp2_conn *tconn, void *user_data)
+ 
+   ctx->tls_vrfy_result = Curl_vquic_tls_verify_peer(&ctx->tls, cf,
+                                                     data, &ctx->peer);
++  if(ctx->tls_vrfy_result)
++    return NGTCP2_ERR_CALLBACK_FAILURE;
++
+ #ifndef CURL_DISABLE_VERBOSE_STRINGS
+   if(Curl_trc_is_verbose(data)) {
+     const ngtcp2_transport_params *rp;
+@@ -1440,6 +1443,8 @@ static CURLcode cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
+ out:
+   result = Curl_1st_err(result, cf_progress_egress(cf, data, &pktx));
+   result = Curl_1st_err(result, check_and_set_expiry(cf, data, &pktx));
++  if(ctx->tls_vrfy_result)
++    result = ctx->tls_vrfy_result;
+ denied:
+   CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_recv(blen=%zu) -> %d, %zu",
+               stream ? stream->id : -1, blen, result, *pnread);
+@@ -1767,6 +1772,8 @@ static CURLcode cf_ngtcp2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
+ 
+ out:
+   result = Curl_1st_err(result, check_and_set_expiry(cf, data, &pktx));
++  if(ctx->tls_vrfy_result)
++    result = ctx->tls_vrfy_result;
+ denied:
+   CURL_TRC_CF(data, cf, "[%" PRId64 "] cf_send(len=%zu) -> %d, %zu",
+               stream ? stream->id : -1, len, result, *pnwritten);
+@@ -2694,6 +2701,8 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
+   }
+ 
+ out:
++  if(ctx->tls_vrfy_result)
++    result = ctx->tls_vrfy_result;
+   if(ctx->qconn &&
+      ((result == CURLE_RECV_ERROR) || (result == CURLE_SEND_ERROR)) &&
+      ngtcp2_conn_in_draining_period(ctx->qconn)) {
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index a1a81c4..8ecf03b 100644
--- a/curl.spec
+++ b/curl.spec
@@ -81,6 +81,9 @@ Patch018: 0018-curl-8.18.0-CVE-2026-8927.patch
 # Fix sending old referer (CVE-2026-9546)
 Patch019: 0019-curl-8.18.0-CVE-2026-9546.patch
 
+# Fix exposing HTTP/3 early data (CVE-2026-9545)
+Patch020: 0020-curl-8.18.0-CVE-2026-9545.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -512,6 +515,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - Fix SASL double-free (CVE-2026-8925)
 - Fix env-set cross-proxy Digest auth state leak (CVE-2026-8927)
 - Fix sending old referer (CVE-2026-9546)
+- Fix exposing HTTP/3 early data (CVE-2026-9545)
 
 * Wed Jul 29 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-8
 - Fix trailing dot domain super cookie (CVE-2026-8924)