[rpms/curl] f43: Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse

[rpms/curl] f43: Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f43
Commit : 37709a14017334f6b56c0c6b367a6496cb23f945
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-26T16:05:57+02:00
Stats  : +71/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/37709a14017334f6b56c0c6b367a6496cb23f945?branch=f43

Log:
Resolves: CVE-2026-8286 - wrong STARTTLS connection reuse

---
diff --git a/0014-curl-8.15.0-CVE-2026-8286.patch b/0014-curl-8.15.0-CVE-2026-8286.patch
new file mode 100644
index 0000000..ad0910c
--- /dev/null
+++ b/0014-curl-8.15.0-CVE-2026-8286.patch
@@ -0,0 +1,67 @@
+From f44eeb28658b43d61eb81dfaef47eba70770283e Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+(cherry picked from commit a86efdd7ca5433de9231e650f18247de8319ad16)
+---
+ lib/url.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index fd3bb575c7..b04ed7e10c 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -803,7 +803,11 @@ struct url_conn_match {
+   BIT(want_proxy_ntlm_http);
+   BIT(want_nego_http);
+   BIT(want_proxy_nego_http);
+-
++  BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse
++                 * connections that have matching TLS configuration.
++                 * Always TRUE if `require_tls` is TRUE. */
++  BIT(require_tls); /* Requires TLS use from a clear-text start, can only
++                 * reuse connections that have TLS. */
+   BIT(wait_pipe);
+   BIT(force_reuse);
+   BIT(seen_pending_conn);
+@@ -954,6 +958,9 @@ static bool url_match_ssl_use(struct connectdata *conn,
+     if(get_protocol_family(conn->handler) != m->needle->handler->protocol)
+       return FALSE;
+   }
++  else if(m->require_tls)
++    /* a clear-text STARTTLS protocol with required TLS */
++    return FALSE;
+   return TRUE;
+ }
+ 
+@@ -1144,8 +1151,8 @@ static bool url_match_destination(struct connectdata *conn,
+ static bool url_match_ssl_config(struct connectdata *conn,
+                                  struct url_conn_match *m)
+ {
+-  /* If talking TLS, conn needs to use the same SSL options. */
+-  if((m->needle->handler->flags & PROTOPT_SSL) &&
++  /* If talking/upgrading to TLS, conn needs to use the same SSL options. */
++  if(((m->needle->handler->flags & PROTOPT_SSL) || m->may_tls) &&
+      !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {
+     DEBUGF(infof(m->data,
+                  "Connection #%" FMT_OFF_T
+@@ -1416,6 +1423,8 @@ ConnectionExists(struct Curl_easy *data,
+     (needle->handler->protocol & PROTO_FAMILY_HTTP);
+ #endif
+ #endif
++  match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++  match.may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+ 
+   /* Find a connection in the pool that matches what "data + needle"
+    * requires. If a suitable candidate is found, it is attached to "data". */
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 725f60c..f74c427 100644
--- a/curl.spec
+++ b/curl.spec
@@ -55,6 +55,9 @@ Patch012: 0012-curl-8.15.0-CVE-2026-8924.patch
 # fix proto-default skips SSH verification (CVE-2026-12064)
 Patch013: 0013-curl-8.15.0-CVE-2026-12064.patch
 
+# fix wrong STARTTLS connection reuse (CVE-2026-8286)
+Patch014: 0014-curl-8.15.0-CVE-2026-8286.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -456,6 +459,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 %changelog
 * Wed Aug 26 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-9
 - fix proto-default skips SSH verification (CVE-2026-12064)
+- fix wrong STARTTLS connection reuse (CVE-2026-8286)
 
 * Mon Aug 03 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-8
 - fix cross-proxy Digest auth state leak (CVE-2026-7168)