[rpms/curl] f44: Resolves: CVE-2026-8458 - wrong reuse for different services

[rpms/curl] f44: Resolves: CVE-2026-8458 - wrong reuse for different services

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f44
Commit : 36d78322637794048cbf72be708508b2e728daba
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-27T16:00:10+02:00
Stats  : +128/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/36d78322637794048cbf72be708508b2e728daba?branch=f44

Log:
Resolves: CVE-2026-8458 - wrong reuse for different services

---
diff --git a/0025-curl-8.18.0-CVE-2026-8458.patch b/0025-curl-8.18.0-CVE-2026-8458.patch
new file mode 100644
index 0000000..0708bbc
--- /dev/null
+++ b/0025-curl-8.18.0-CVE-2026-8458.patch
@@ -0,0 +1,124 @@
+From 179746545e59d241dfb9901588a60bbd100397ea Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Wed, 13 May 2026 12:02:48 +0200
+Subject: [PATCH] creds: add sasl service name
+
+The SASL service name, used in authentication, is part of curl's credentials
+when authenticating to a server/proxy. Make it part of the connection's
+credentials so that connection reuse is only allowed when the service
+name matches.
+
+Closes #21585
+
+(cherry picked from commit 5e99b73cf441d9c369768b9cd48b5389b9a2503d)
+Co-authored-by: Cursor <cursoragent@cursor.com>
+---
+ lib/url.c     | 36 +++++++++++++++++++++++++++++++-----
+ lib/urldata.h |  2 ++
+ 2 files changed, 33 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 900b0f7352..c3fb1439ca 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -538,6 +538,8 @@ void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn)
+   Curl_safefree(conn->sasl_authzid);
+   Curl_safefree(conn->options);
+   Curl_safefree(conn->oauth_bearer);
++  Curl_safefree(conn->sasl_service);
++  Curl_safefree(conn->proxy_service);
+   Curl_safefree(conn->host.rawalloc); /* hostname buffer */
+   Curl_safefree(conn->conn_to_host.rawalloc); /* hostname buffer */
+   Curl_safefree(conn->hostname_resolve);
+@@ -1032,7 +1034,8 @@ static bool url_match_auth(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+        Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
+        Curl_timestrcmp(m->needle->sasl_authzid, conn->sasl_authzid) ||
+-       Curl_timestrcmp(m->needle->oauth_bearer, conn->oauth_bearer)) {
++       Curl_timestrcmp(m->needle->oauth_bearer, conn->oauth_bearer) ||
++       Curl_timestrcmp(m->needle->sasl_service, conn->sasl_service)) {
+       /* one of them was different */
+       return FALSE;
+     }
+@@ -1114,7 +1117,8 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+      partway through a handshake!) */
+   if(m->want_ntlm_http) {
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+-       Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
++       Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++       Curl_timestrcmp(m->needle->sasl_service, conn->sasl_service)) {
+ 
+       /* we prefer a credential match, but this is at least a connection
+          that can be reused and "upgraded" to NTLM */
+@@ -1139,7 +1143,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->http_proxy.user,
+                        conn->http_proxy.user) ||
+        Curl_timestrcmp(m->needle->http_proxy.passwd,
+-                       conn->http_proxy.passwd))
++                       conn->http_proxy.passwd) ||
++       Curl_timestrcmp(m->needle->proxy_service,
++                       conn->proxy_service))
+       return FALSE;
+   }
+   else if(conn->proxy_ntlm_state != NTLMSTATE_NONE) {
+@@ -1180,7 +1186,8 @@ static bool url_match_auth_nego(struct connectdata *conn,
+      so that we can reuse Negotiate connections if possible. */
+   if(m->want_nego_http) {
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+-       Curl_timestrcmp(m->needle->passwd, conn->passwd))
++       Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++       Curl_timestrcmp(m->needle->sasl_service, conn->sasl_service))
+       return FALSE;
+   }
+   else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+@@ -1199,7 +1206,9 @@ static bool url_match_auth_nego(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->http_proxy.user,
+                        conn->http_proxy.user) ||
+        Curl_timestrcmp(m->needle->http_proxy.passwd,
+-                       conn->http_proxy.passwd))
++                       conn->http_proxy.passwd) ||
++       Curl_timestrcmp(m->needle->proxy_service,
++                       conn->proxy_service))
+       return FALSE;
+   }
+   else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+@@ -3505,6 +3514,23 @@ static CURLcode create_conn(struct Curl_easy *data,
+     }
+   }
+ 
++  if(data->set.str[STRING_SERVICE_NAME]) {
++    conn->sasl_service = curlx_strdup(data->set.str[STRING_SERVICE_NAME]);
++    if(!conn->sasl_service) {
++      result = CURLE_OUT_OF_MEMORY;
++      goto out;
++    }
++  }
++
++  if(data->set.str[STRING_PROXY_SERVICE_NAME]) {
++    conn->proxy_service =
++      curlx_strdup(data->set.str[STRING_PROXY_SERVICE_NAME]);
++    if(!conn->proxy_service) {
++      result = CURLE_OUT_OF_MEMORY;
++      goto out;
++    }
++  }
++
+ #ifdef USE_UNIX_SOCKETS
+   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
+     conn->unix_domain_socket =
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 7e36cc2336..318dfdb84c 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -637,6 +637,8 @@ struct connectdata {
+   char *options; /* options string, allocated */
+   char *sasl_authzid;     /* authorization identity string, allocated */
+   char *oauth_bearer; /* OAUTH2 bearer, allocated */
++  char *sasl_service; /* SASL service name, allocated */
++  char *proxy_service; /* proxy SASL service name, allocated */
+   struct curltime created; /* creation time */
+   struct curltime lastused; /* when returned to the connection poolas idle */
+ 
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 6f84fc4..d398785 100644
--- a/curl.spec
+++ b/curl.spec
@@ -96,6 +96,9 @@ Patch023: 0023-curl-8.18.0-CVE-2026-11564.patch
 # Fix stale proxy password leak (CVE-2026-9079)
 Patch024: 0024-curl-8.18.0-CVE-2026-9079.patch
 
+# Fix wrong reuse for different services (CVE-2026-8458)
+Patch025: 0025-curl-8.18.0-CVE-2026-8458.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -526,6 +529,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 - Fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
 - Fix Native CA trust persist (CVE-2026-11564)
 - Fix stale proxy password leak (CVE-2026-9079)
+- Fix wrong reuse for different services (CVE-2026-8458)
 
 * Mon Aug 24 2026 Jan Macku <jamacku@redhat.com> - 8.18.0-9
 - Fix QUIC zero-length UDP datagrams busy-loop (CVE-2026-11352)