From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: Jan Macku To: git-commits@fedoraproject.org Subject: [rpms/curl] f43: Resolves: CVE-2026-9545 - exposing HTTP/3 early data Date: Thu, 27 Aug 2026 15:01:16 GMT Message-ID: <178784287619.1.11268742266415808151.rpms-curl-83347b000d38@fedoraproject.org> List-ID: X-Git-Repo: rpms/curl X-Git-Branch: f43 X-Git-Rev: 83347b000d38a5f7883ece673c0a3fca6da347d8 QSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KClJlcG8gICA6IHJwbXMvY3VybApCcmFuY2gg OiBmNDMKQ29tbWl0IDogODMzNDdiMDAwZDM4YTVmNzg4M2VjZTY3M2MwYTNmY2E2ZGEzNDdkOApB dXRob3IgOiBKYW4gTWFja3UgPGphbWFja3VAcmVkaGF0LmNvbT4KRGF0ZSAgIDogMjAyNi0wOC0y NlQxOTo0NDoxMSswMjowMApTdGF0cyAgOiArNzYvLTAgaW4gMiBmaWxlKHMpClVSTCAgICA6IGh0 dHBzOi8vc3JjLmZlZG9yYXByb2plY3Qub3JnL3JwbXMvY3VybC9jLzgzMzQ3YjAwMGQzOGE1Zjc4 ODNlY2U2NzNjMGEzZmNhNmRhMzQ3ZDg/YnJhbmNoPWY0MwoKTG9nOgpSZXNvbHZlczogQ1ZFLTIw MjYtOTU0NSAtIGV4cG9zaW5nIEhUVFAvMyBlYXJseSBkYXRhCgotLS0KZGlmZiAtLWdpdCBhLzAw MTctY3VybC04LjE1LjAtQ1ZFLTIwMjYtOTU0NS5wYXRjaCBiLzAwMTctY3VybC04LjE1LjAtQ1ZF LTIwMjYtOTU0NS5wYXRjaApuZXcgZmlsZSBtb2RlIDEwMDY0NAppbmRleCAwMDAwMDAwLi44ZGY2 MjlmCi0tLSAvZGV2L251bGwKKysrIGIvMDAxNy1jdXJsLTguMTUuMC1DVkUtMjAyNi05NTQ1LnBh dGNoCkBAIC0wLDAgKzEsNzIgQEAKK0Zyb20gYjhjOWZkOTdjMTc4NmMyY2Q0N2ZhYTJkM2I2NDZj MTM0ZjQxZGI1NCBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IFN0ZWZhbiBFaXNzaW5n IDxzdGVmYW5AZWlzc2luZy5vcmc+CitEYXRlOiBUaHUsIDIxIE1heSAyMDI2IDE0OjIxOjU5ICsw MjAwCitTdWJqZWN0OiBbUEFUQ0hdIG5ndGNwMjogZmFpbCBoYW5kc2hha2UgZGlyZWN0bHkKKwor V2hlbiBjZXJ0aWZpY2F0ZSB2ZXJpZmljYXRpb24gZmFpbHMsIGVycm9yIG91dCBvZiB0aGUgaGFu ZHNoYWtlCitjYWxsYmFjaywgZm9yY2luZyBuZ3RjcDIgdG8gc3RvcCBwcm9jZXNzaW5nIHRoZSBj b25uZWN0aW9uIGFueSBmdXJ0aGVyLgorCitDbG9zZXMgIzIxNzEyCisKKyhjaGVycnkgcGlja2Vk IGZyb20gY29tbWl0IDdiOTYxM2ZhOWIxYTVlMDQzMDFhMzkyMGVlZjU4ZTgxMzhkYWQwNWUpCist LS0KKyBsaWIvdnF1aWMvY3VybF9uZ3RjcDIuYyB8IDE0ICsrKysrKysrKysrLS0tCisgMSBmaWxl IGNoYW5nZWQsIDExIGluc2VydGlvbnMoKyksIDMgZGVsZXRpb25zKC0pCisKK2RpZmYgLS1naXQg YS9saWIvdnF1aWMvY3VybF9uZ3RjcDIuYyBiL2xpYi92cXVpYy9jdXJsX25ndGNwMi5jCitpbmRl eCA2OWQ1NGVjY2UyLi4yNGZlN2VjMGIwIDEwMDY0NAorLS0tIGEvbGliL3ZxdWljL2N1cmxfbmd0 Y3AyLmMKKysrKyBiL2xpYi92cXVpYy9jdXJsX25ndGNwMi5jCitAQCAtNDYzLDcgKzQ2Myw3IEBA IHN0YXRpYyBpbnQgY2Zfbmd0Y3AyX2hhbmRzaGFrZV9jb21wbGV0ZWQobmd0Y3AyX2Nvbm4gKnRj b25uLCB2b2lkICp1c2VyX2RhdGEpCisgICBkYXRhID0gQ0ZfREFUQV9DVVJSRU5UKGNmKTsKKyAg IERFQlVHQVNTRVJUKGRhdGEpOworICAgaWYoIWN0eCB8fCAhZGF0YSkKKy0gICAgcmV0dXJuIE5H SFRUUDNfRVJSX0NBTExCQUNLX0ZBSUxVUkU7CisrICAgIHJldHVybiBOR1RDUDJfRVJSX0NBTExC QUNLX0ZBSUxVUkU7CisgCisgICBjdHgtPmhhbmRzaGFrZV9hdCA9IGN1cmx4X25vdygpOworICAg Y3R4LT50bHNfaGFuZHNoYWtlX2NvbXBsZXRlID0gVFJVRTsKK0BAIC00NzIsNiArNDcyLDkgQEAg c3RhdGljIGludCBjZl9uZ3RjcDJfaGFuZHNoYWtlX2NvbXBsZXRlZChuZ3RjcDJfY29ubiAqdGNv bm4sIHZvaWQgKnVzZXJfZGF0YSkKKyAKKyAgIGN0eC0+dGxzX3ZyZnlfcmVzdWx0ID0gQ3VybF92 cXVpY190bHNfdmVyaWZ5X3BlZXIoJmN0eC0+dGxzLCBjZiwKKyAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgZGF0YSwgJmN0eC0+cGVlcik7CisrICBp ZihjdHgtPnRsc192cmZ5X3Jlc3VsdCkKKysgICAgcmV0dXJuIE5HVENQMl9FUlJfQ0FMTEJBQ0tf RkFJTFVSRTsKKysKKyAgIENVUkxfVFJDX0NGKGRhdGEsIGNmLCAiaGFuZHNoYWtlIGNvbXBsZXRl IGFmdGVyICVkbXMiLAorICAgICAgICAgICAgICAoaW50KWN1cmx4X3RpbWVkaWZmKGN0eC0+aGFu ZHNoYWtlX2F0LCBjdHgtPnN0YXJ0ZWRfYXQpKTsKKyAgIC8qIEluIGNhc2Ugb2YgZWFybHlkYXRh LCB3aGVyZSB3ZSBzaW11bGF0ZSBiZWluZyBjb25uZWN0ZWQsIHVwZGF0ZQorQEAgLTEzMjksOSAr MTMzMiwxMCBAQCBzdGF0aWMgQ1VSTGNvZGUgY2Zfbmd0Y3AyX3JlY3Yoc3RydWN0IEN1cmxfY2Zp bHRlciAqY2YsIHN0cnVjdCBDdXJsX2Vhc3kgKmRhdGEsCisgb3V0OgorICAgcmVzdWx0ID0gQ3Vy bF8xc3RfZXJyKHJlc3VsdCwgY2ZfcHJvZ3Jlc3NfZWdyZXNzKGNmLCBkYXRhLCAmcGt0eCkpOwor ICAgcmVzdWx0ID0gQ3VybF8xc3RfZXJyKHJlc3VsdCwgY2hlY2tfYW5kX3NldF9leHBpcnkoY2Ys IGRhdGEsICZwa3R4KSk7CisrICBpZihjdHgtPnRsc192cmZ5X3Jlc3VsdCkKKysgICAgcmVzdWx0 ID0gY3R4LT50bHNfdnJmeV9yZXN1bHQ7CisgCistICBDVVJMX1RSQ19DRihkYXRhLCBjZiwgIlsl IiBGTVRfUFJJZDY0ICJdIGNmX3JlY3YoYmxlbj0lenUpIC0+ICVkbSwgJXp1IiwKKy0KKysgIENV UkxfVFJDX0NGKGRhdGEsIGNmLCAiWyUiIEZNVF9QUklkNjQgIl0gY2ZfcmVjdihibGVuPSV6dSkg LT4gJWQsICV6dSIsCisgICAgICAgICAgICAgICBzdHJlYW0gPyBzdHJlYW0tPmlkIDogLTEsIGJs ZW4sIHJlc3VsdCwgKnBucmVhZCk7CisgICBDRl9EQVRBX1JFU1RPUkUoY2YsIHNhdmUpOworICAg cmV0dXJuIHJlc3VsdDsKK0BAIC0xNjU3LDYgKzE2NjEsOCBAQCBzdGF0aWMgQ1VSTGNvZGUgY2Zf bmd0Y3AyX3NlbmQoc3RydWN0IEN1cmxfY2ZpbHRlciAqY2YsIHN0cnVjdCBDdXJsX2Vhc3kgKmRh dGEsCisgCisgb3V0OgorICAgcmVzdWx0ID0gQ3VybF8xc3RfZXJyKHJlc3VsdCwgY2hlY2tfYW5k X3NldF9leHBpcnkoY2YsIGRhdGEsICZwa3R4KSk7CisrICBpZihjdHgtPnRsc192cmZ5X3Jlc3Vs dCkKKysgICAgcmVzdWx0ID0gY3R4LT50bHNfdnJmeV9yZXN1bHQ7CisgCisgICBDVVJMX1RSQ19D RihkYXRhLCBjZiwgIlslIiBGTVRfUFJJZDY0ICJdIGNmX3NlbmQobGVuPSV6dSkgLT4gJWQsICV6 dSIsCisgICAgICAgICAgICAgICBzdHJlYW0gPyBzdHJlYW0tPmlkIDogLTEsIGxlbiwgcmVzdWx0 LCAqcG53cml0dGVuKTsKK0BAIC0yNTY1LDYgKzI1NzEsOCBAQCBzdGF0aWMgQ1VSTGNvZGUgY2Zf bmd0Y3AyX2Nvbm5lY3Qoc3RydWN0IEN1cmxfY2ZpbHRlciAqY2YsCisgICB9CisgCisgb3V0Ogor KyAgaWYoY3R4LT50bHNfdnJmeV9yZXN1bHQpCisrICAgIHJlc3VsdCA9IGN0eC0+dGxzX3ZyZnlf cmVzdWx0OworICAgaWYocmVzdWx0ID09IENVUkxFX1JFQ1ZfRVJST1IgJiYgY3R4LT5xY29ubiAm JgorICAgICAgbmd0Y3AyX2Nvbm5faW5fZHJhaW5pbmdfcGVyaW9kKGN0eC0+cWNvbm4pKSB7Cisg ICAgIC8qIFdoZW4gYSBRVUlDIHNlcnZlciBpbnN0YW5jZSBpcyBzaHV0dGluZyBkb3duLCBpdCBt YXkgc2VuZCB1cyBhCistLSAKKzIuNTUuMAorCgpkaWZmIC0tZ2l0IGEvY3VybC5zcGVjIGIvY3Vy bC5zcGVjCmluZGV4IGVlYjljNDMuLmVlNmZkZDkgMTAwNjQ0Ci0tLSBhL2N1cmwuc3BlYworKysg Yi9jdXJsLnNwZWMKQEAgLTY0LDYgKzY0LDkgQEAgUGF0Y2gwMTU6IDAwMTUtY3VybC04LjE1LjAt Q1ZFLTIwMjYtODkyNS5wYXRjaAogIyBmaXggZW52LXNldCBjcm9zcy1wcm94eSBEaWdlc3QgYXV0 aCBzdGF0ZSBsZWFrIChDVkUtMjAyNi04OTI3KQogUGF0Y2gwMTY6IDAwMTYtY3VybC04LjE1LjAt Q1ZFLTIwMjYtODkyNy5wYXRjaAogCisjIGZpeCBleHBvc2luZyBIVFRQLzMgZWFybHkgZGF0YSAo Q1ZFLTIwMjYtOTU0NSkKK1BhdGNoMDE3OiAwMDE3LWN1cmwtOC4xNS4wLUNWRS0yMDI2LTk1NDUu cGF0Y2gKKwogIyBwYXRjaCBtYWtpbmcgbGliY3VybCBtdWx0aWxpYiByZWFkeQogUGF0Y2gxMDE6 IDAxMDEtY3VybC03LjMyLjAtbXVsdGlsaWIucGF0Y2gKIApAQCAtNDY4LDYgKzQ3MSw3IEBAIHJt IC1mICR7UlBNX0JVSUxEX1JPT1R9JXtfbWFuZGlyfS9tYW4xL3djdXJsLjEqCiAtIGZpeCB3cm9u ZyBTVEFSVFRMUyBjb25uZWN0aW9uIHJldXNlIChDVkUtMjAyNi04Mjg2KQogLSBmaXggU0FTTCBk b3VibGUtZnJlZSAoQ1ZFLTIwMjYtODkyNSkKIC0gZml4IGVudi1zZXQgY3Jvc3MtcHJveHkgRGln ZXN0IGF1dGggc3RhdGUgbGVhayAoQ1ZFLTIwMjYtODkyNykKKy0gZml4IGV4cG9zaW5nIEhUVFAv MyBlYXJseSBkYXRhIChDVkUtMjAyNi05NTQ1KQogCiAqIE1vbiBBdWcgMDMgMjAyNiBKYW4gTWFj a3UgPGphbWFja3VAcmVkaGF0LmNvbT4gLSA4LjE1LjAtOAogLSBmaXggY3Jvc3MtcHJveHkgRGln ZXN0IGF1dGggc3RhdGUgbGVhayAoQ1ZFLTIwMjYtNzE2OCkK