[rpms/curl] f44: Resolves: CVE-2026-11564 - Native CA trust persist

[Jan Macku <jamacku@redhat.com>]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : fbb3044b76e9dc5b5950db2353eb510d59ed0ceb
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-27T15:54:26+02:00
Stats  : +128/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/fbb3044b76e9dc5b5950db2353eb510d59ed0ceb?branch=f44

Log:
Resolves: CVE-2026-11564 - Native CA trust persist

---
diff --git a/0023-curl-8.18.0-CVE-2026-11564.patch b/0023-curl-8.18.0-CVE-2026-11564.patch
new file mode 100644
index 0000000..26433cc
--- /dev/null
+++ b/0023-curl-8.18.0-CVE-2026-11564.patch
@@ -0,0 +1,124 @@
+From 900bbf21f1bc13b123fd6bd0c1f5c4d31197330d Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 8 Jun 2026 10:11:30 +0200
+Subject: [PATCH] ssl native_ca_store: always reinit
+
+Add bit `native_ca_store_opt` to keep the setting of
+CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy
+transfer if a native CA store shall be used or not.
+
+This avoids `native_ca_store` getting stuck on TRUE after being set
+once.
+
+Closes #21902
+
+(cherry picked from commit d69bfad3fa3daf5e72331f6870667607828d5891)
+---
+ lib/doh.c       |  3 ++-
+ lib/setopt.c    | 20 ++------------------
+ lib/vtls/vtls.c | 19 +++++++++++++++++++
+ 3 files changed, 23 insertions(+), 19 deletions(-)
+
+diff --git a/lib/doh.c b/lib/doh.c
+index 9052fab26b..13497e0253 100644
+--- a/lib/doh.c
++++ b/lib/doh.c
+@@ -400,7 +400,8 @@ static CURLcode doh_probe_run(struct Curl_easy *data,
+   }
+ 
+   (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS,
+-                         (long)data->set.ssl.primary.ssl_options);
++                         ((long)data->set.ssl.primary.ssl_options &
++                           ~CURLSSLOPT_AUTO_CLIENT_CERT));
+ 
+   doh->state.internal = TRUE;
+   doh->master_mid = data->mid; /* master transfer of this one */
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 355a59c0a1..089390030c 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -414,22 +414,6 @@ static CURLcode setopt_RTSP_REQUEST(struct Curl_easy *data, long arg)
+ }
+ #endif /* !CURL_DISABLE_RTSP */
+ 
+-#ifdef USE_SSL
+-static void set_ssl_options(struct ssl_config_data *ssl,
+-                            struct ssl_primary_config *config,
+-                            long arg)
+-{
+-  config->ssl_options = (unsigned char)(arg & 0xff);
+-  ssl->enable_beast = !!(arg & CURLSSLOPT_ALLOW_BEAST);
+-  ssl->no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
+-  ssl->no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
+-  ssl->revoke_best_effort = !!(arg & CURLSSLOPT_REVOKE_BEST_EFFORT);
+-  ssl->native_ca_store = !!(arg & CURLSSLOPT_NATIVE_CA);
+-  ssl->auto_client_cert = !!(arg & CURLSSLOPT_AUTO_CLIENT_CERT);
+-  ssl->earlydata = !!(arg & CURLSSLOPT_EARLYDATA);
+-}
+-#endif
+-
+ static CURLcode setopt_bool(struct Curl_easy *data, CURLoption option,
+                             long arg, bool *set)
+ {
+@@ -1127,12 +1111,12 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
+     s->use_ssl = (unsigned char)arg;
+     break;
+   case CURLOPT_SSL_OPTIONS:
+-    set_ssl_options(&s->ssl, &s->ssl.primary, arg);
++    s->ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+     break;
+ 
+ #ifndef CURL_DISABLE_PROXY
+   case CURLOPT_PROXY_SSL_OPTIONS:
+-    set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg);
++    s->proxy_ssl.primary.ssl_options = (unsigned char)(arg & 0xff);
+     break;
+ #endif
+ 
+diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
+index be0c032bff..851bc341a9 100644
+--- a/lib/vtls/vtls.c
++++ b/lib/vtls/vtls.c
+@@ -286,6 +286,21 @@ static void free_primary_ssl_config(struct ssl_primary_config *sslc)
+ #endif
+ }
+ 
++static void ssl_easy_config_compl_options(struct ssl_config_data *sslc)
++{
++  unsigned char options = sslc->primary.ssl_options;
++  /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
++   * If not, we switch it on for supported backends if no custom
++   * ca settings exist. */
++  sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
++  sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
++  sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
++  sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
++  sslc->revoke_best_effort = !!(options & CURLSSLOPT_REVOKE_BEST_EFFORT);
++  sslc->auto_client_cert = !!(options & CURLSSLOPT_AUTO_CLIENT_CERT);
++  sslc->earlydata = !!(options & CURLSSLOPT_EARLYDATA);
++}
++
+ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ {
+   struct ssl_config_data *sslc = &data->set.ssl;
+@@ -294,6 +309,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+   CURLcode result;
+ #endif
+ 
++  ssl_easy_config_compl_options(sslc);
++
+   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #ifdef USE_APPLE_SECTRUST
+     if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+@@ -340,6 +357,8 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data)
+ 
+ #ifndef CURL_DISABLE_PROXY
+   sslc = &data->set.proxy_ssl;
++  ssl_easy_config_compl_options(sslc);
++
+   if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
+ #ifdef USE_APPLE_SECTRUST
+     if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 196f505..fa58372 100644
--- a/curl.spec
+++ b/curl.spec
@@ -90,6 +90,9 @@ Patch021: 0021-curl-8.18.0-CVE-2026-9080.patch
 # Fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
 Patch022: 0022-curl-8.18.0-CVE-2026-10536.patch
 
+# Fix Native CA trust persist (CVE-2026-11564)
+Patch023: 0023-curl-8.18.0-CVE-2026-11564.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -518,6 +521,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 %changelog
 * Tue Sep 08 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-10
 - Fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
+- Fix Native CA trust persist (CVE-2026-11564)
 
 * Mon Aug 24 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-9
 - Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)