[rpms/curl] f43: Resolves: CVE-2026-9079 - stale proxy password leak

[rpms/curl] f43: Resolves: CVE-2026-9079 - stale proxy password leak

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f43
Commit : 1c9f1f8d61ef36fcc8250989b6ab87a23fca28c6
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-27T18:38:13+02:00
Stats  : +290/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/1c9f1f8d61ef36fcc8250989b6ab87a23fca28c6?branch=f43

Log:
Resolves: CVE-2026-9079 - stale proxy password leak

---
diff --git a/0020-curl-8.15.0-CVE-2026-9079.patch b/0020-curl-8.15.0-CVE-2026-9079.patch
new file mode 100644
index 0000000..8e0a2e6
--- /dev/null
+++ b/0020-curl-8.15.0-CVE-2026-9079.patch
@@ -0,0 +1,286 @@
+From 8f84686f10a2c82a55d447e2e322944614ab3785 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 20 May 2026 13:39:25 +0200
+Subject: [PATCH] setopt: clear proxy auth properly on NULL
+
+Verify NULLed proxy credentials with test1648
+
+Closes #21696
+
+(cherry picked from commit 88c7e16cceec816a2df45c899d49b1e85513f193)
+---
+ lib/setopt.c               |  12 ++--
+ tests/data/Makefile.am     |   2 +-
+ tests/data/test1648        |  63 +++++++++++++++++
+ tests/libtest/Makefile.inc |   2 +-
+ tests/libtest/lib1648.c    | 135 +++++++++++++++++++++++++++++++++++++
+ 5 files changed, 206 insertions(+), 8 deletions(-)
+ create mode 100644 tests/data/test1648
+ create mode 100644 tests/libtest/lib1648.c
+
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 7d3c0a1a7b..8be5eef059 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -2162,16 +2162,16 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
+     result = setstropt_userpwd(ptr, &u, &p);
+ 
+     /* URL decode the components */
+-    if(!result && u) {
++    if(!result) {
+       Curl_safefree(data->set.str[STRING_PROXYUSERNAME]);
+-      result = Curl_urldecode(u, 0, &data->set.str[STRING_PROXYUSERNAME], NULL,
+-                              REJECT_ZERO);
+-    }
+-    if(!result && p) {
+       Curl_safefree(data->set.str[STRING_PROXYPASSWORD]);
++      if(u)
++        result = Curl_urldecode(u, 0, &data->set.str[STRING_PROXYUSERNAME],
++                                NULL, REJECT_ZERO);
++    }
++    if(!result && p)
+       result = Curl_urldecode(p, 0, &data->set.str[STRING_PROXYPASSWORD], NULL,
+                               REJECT_ZERO);
+-    }
+     free(u);
+     free(p);
+   }
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index f18dba0537..6a60f1ce4f 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -217,7 +217,7 @@ test1614 test1615 test1616 \
+ test1620 test1621 \
+ test1629 \
+ \
+-test1630 test1631 test1632 test1633 test1634 test1635 test1647 \
++test1630 test1631 test1632 test1633 test1634 test1635 test1647 test1648 \
+ \
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
+ test1658 \
+diff --git a/tests/data/test1648 b/tests/data/test1648
+new file mode 100644
+index 0000000000..623f3c9a81
+--- /dev/null
++++ b/tests/data/test1648
+@@ -0,0 +1,63 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy auth
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="headers" nocheck="yes">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++proxy
++</features>
++<name>
++HTTP proxy with auth, change proxy, clear auth
++</name>
++<command>
++%HOSTIP %HTTPPORT
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET http://example.com/ HTTP/1.1
++Host: example.com
++Proxy-Authorization: Basic %b64[victim:secret]b64%
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://example.com/ HTTP/1.1
++Host: example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index c73e2c2ebd..6ae5bb6d04 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -78,7 +78,7 @@ TESTS_C = \
+   lib1576.c lib1588.c \
+   lib1591.c lib1592.c lib1593.c lib1594.c                     lib1597.c \
+   lib1598.c lib1599.c \
+-  lib1647.c \
++  lib1647.c lib1648.c \
+   lib1662.c \
+   lib1686.c \
+   lib1900.c lib1901.c           lib1903.c lib1905.c lib1906.c lib1907.c \
+diff --git a/tests/libtest/lib1648.c b/tests/libtest/lib1648.c
+new file mode 100644
+index 0000000000..e97b2bdc88
+--- /dev/null
++++ b/tests/libtest/lib1648.c
+@@ -0,0 +1,135 @@
++/***************************************************************************
++ *                                  _   _ ____  _
++ *  Project                     ___| | | |  _ \| |
++ *                             / __| | | | |_) | |
++ *                            | (__| |_| |  _ <| |___
++ *                             \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * URL = host
++ * arg2 = port
++ */
++
++#include "first.h"
++
++/* this is meant to pick up the proxy from the environment variable */
++static CURLcode init1648(CURL *curl, const char *url, const char *proxy)
++{
++  CURLcode res = CURLE_OK;
++
++  res_easy_setopt(curl, CURLOPT_URL, url);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_PROXY, proxy);
++  if(res)
++    goto init_failed;
++
++  res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++  if(res)
++    goto init_failed;
++
++  return CURLE_OK; /* success */
++
++init_failed:
++  return res; /* failure */
++}
++
++static CURLcode run1648(CURL *curl, const char *url, const char *userpwd)
++{
++  CURLcode res = CURLE_OK;
++
++  res = init1648(curl, url, userpwd);
++  if(res)
++    return res;
++
++  return curl_easy_perform(curl);
++}
++
++#define GET_THIS "http://example.com/"
++
++/*
++ * First get the URL over 'firstproxy' with auth.
++ * Then clear the auth and get the URL again over 'secondproxy'.
++ */
++static CURLcode test_lib1648(char *hostip)
++{
++  CURLcode res = CURLE_OK;
++  CURL *curl = NULL;
++  struct curl_slist *host = NULL;
++  struct curl_slist *host2 = NULL;
++  char proxy1_resolve[128];
++  char proxy2_resolve[128];
++  char proxy1_connect[128];
++  char proxy2_connect[128];
++
++  curl_msnprintf(proxy1_resolve, sizeof(proxy1_resolve),
++                 "firstproxy:%s:%s", libtest_arg2, hostip);
++  curl_msnprintf(proxy2_resolve, sizeof(proxy2_resolve),
++                 "secondproxy:%s:%s", libtest_arg2, hostip);
++
++  /* we connect to the fake host name but the right port number */
++  curl_msnprintf(proxy1_connect, sizeof(proxy1_connect),
++                 "firstproxy:%s", libtest_arg2);
++  curl_msnprintf(proxy2_connect, sizeof(proxy2_connect),
++                 "secondproxy:%s", libtest_arg2);
++
++  res_global_init(CURL_GLOBAL_ALL);
++  if(res)
++    return res;
++
++  curl = curl_easy_init();
++  if(!curl) {
++    curl_mfprintf(stderr, "curl_easy_init() failed\n");
++    curl_global_cleanup();
++    return TEST_ERR_MAJOR_BAD;
++  }
++
++  host = curl_slist_append(NULL, proxy1_resolve);
++  if(!host)
++    goto test_cleanup;
++  host2 = curl_slist_append(host, proxy2_resolve);
++  if(!host2)
++    goto test_cleanup;
++  host = host2;
++
++  start_test_timing();
++
++  easy_setopt(curl, CURLOPT_RESOLVE, host);
++  easy_setopt(curl, CURLOPT_PROXYUSERPWD, "victim:secret");
++
++  curl_mprintf("--- First get over %s\n", proxy1_connect);
++  res = run1648(curl, GET_THIS, proxy1_connect);
++  if(res)
++    goto test_cleanup;
++
++  easy_setopt(curl, CURLOPT_PROXYUSERPWD, NULL);
++
++  curl_mprintf("--- Then over '%s'\n", proxy2_connect);
++  res = run1648(curl, GET_THIS, proxy2_connect);
++
++test_cleanup:
++
++  /* proper cleanup sequence - type PB */
++
++  curl_easy_cleanup(curl);
++  curl_global_cleanup();
++  curl_slist_free_all(host);
++  return res;
++}
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index f1874b5..26302fd 100644
--- a/curl.spec
+++ b/curl.spec
@@ -73,6 +73,9 @@ Patch018: 0018-curl-8.15.0-CVE-2026-9080.patch
 # fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
 Patch019: 0019-curl-8.15.0-CVE-2026-10536.patch
 
+# fix stale proxy password leak (CVE-2026-9079)
+Patch020: 0020-curl-8.15.0-CVE-2026-9079.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -477,6 +480,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 %changelog
 * Tue Sep 08 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-10
 - fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
+- fix stale proxy password leak (CVE-2026-9079)
 
 * Wed Aug 26 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-9
 - fix proto-default skips SSH verification (CVE-2026-12064)