[rpms/curl] f43: Resolves: CVE-2026-8458 - wrong reuse for different services

[rpms/curl] f43: Resolves: CVE-2026-8458 - wrong reuse for different services

[Jan Macku]

A new commit has been pushed.

Repo   : rpms/curl
Branch : f43
Commit : 0951ae1a60273ea23d551d74b5ceb5a19a11684e
Author : Jan Macku <jamacku@redhat.com>
Date   : 2026-08-27T18:38:29+02:00
Stats  : +127/-0 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/curl/c/0951ae1a60273ea23d551d74b5ceb5a19a11684e?branch=f43

Log:
Resolves: CVE-2026-8458 - wrong reuse for different services

---
diff --git a/0021-curl-8.15.0-CVE-2026-8458.patch b/0021-curl-8.15.0-CVE-2026-8458.patch
new file mode 100644
index 0000000..6d7ac5b
--- /dev/null
+++ b/0021-curl-8.15.0-CVE-2026-8458.patch
@@ -0,0 +1,123 @@
+From ecc8e735a6ed5602f5de508d6525109da2e2b126 Mon Sep 17 00:00:00 2001
+From: Jan Macku <jamacku@redhat.com>
+Date: Thu, 27 Aug 2026 17:10:04 +0200
+Subject: [PATCH] url: add SASL service name to connection reuse matching
+
+Store the SASL service name (set via CURLOPT_SERVICE_NAME and
+CURLOPT_PROXY_SERVICE_NAME) on the connection and compare it during
+connection reuse matching for Negotiate and NTLM authentication.
+
+Without this check, libcurl could wrongfully reuse an existing
+connection authenticated with a different service name, when the
+same server, username and password are used.
+
+This is an adapted backport of upstream commit 5e99b73cf441d9c369768b9cd
+which adds sasl_service to struct Curl_creds. Since curl 8.15.0
+predates the Curl_creds infrastructure, this fix stores the service
+name directly on struct connectdata instead, following the same
+pattern as sasl_authzid and oauth_bearer.
+
+(cherry picked from commit 5e99b73cf441d9c369768b9cd)
+Co-authored-by: Cursor <cursoragent@cursor.com>
+---
+ lib/url.c     | 35 +++++++++++++++++++++++++++++++----
+ lib/urldata.h |  2 ++
+ 2 files changed, 33 insertions(+), 4 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+index 6a429a1ce9..a233c9831b 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -589,6 +589,8 @@ void Curl_conn_free(struct Curl_easy *data, struct connectdata *conn)
+   Curl_safefree(conn->sasl_authzid);
+   Curl_safefree(conn->options);
+   Curl_safefree(conn->oauth_bearer);
++  Curl_safefree(conn->sasl_service);
++  Curl_safefree(conn->proxy_sasl_service);
+   Curl_safefree(conn->host.rawalloc); /* hostname buffer */
+   Curl_safefree(conn->conn_to_host.rawalloc); /* hostname buffer */
+   Curl_safefree(conn->hostname_resolve);
+@@ -1170,7 +1172,8 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+      partway through a handshake!) */
+   if(m->want_ntlm_http) {
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+-       Curl_timestrcmp(m->needle->passwd, conn->passwd)) {
++       Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++       Curl_timestrcmp(m->needle->sasl_service, conn->sasl_service)) {
+ 
+       /* we prefer a credential match, but this is at least a connection
+          that can be reused and "upgraded" to NTLM */
+@@ -1195,7 +1198,9 @@ static bool url_match_auth_ntlm(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->http_proxy.user,
+                        conn->http_proxy.user) ||
+        Curl_timestrcmp(m->needle->http_proxy.passwd,
+-                       conn->http_proxy.passwd))
++                       conn->http_proxy.passwd) ||
++       Curl_timestrcmp(m->needle->proxy_sasl_service,
++                       conn->proxy_sasl_service))
+       return FALSE;
+   }
+   else if(conn->proxy_ntlm_state != NTLMSTATE_NONE) {
+@@ -1236,7 +1241,8 @@ static bool url_match_auth_nego(struct connectdata *conn,
+      so that we can reuse Negotiate connections if possible. */
+   if(m->want_nego_http) {
+     if(Curl_timestrcmp(m->needle->user, conn->user) ||
+-       Curl_timestrcmp(m->needle->passwd, conn->passwd))
++       Curl_timestrcmp(m->needle->passwd, conn->passwd) ||
++       Curl_timestrcmp(m->needle->sasl_service, conn->sasl_service))
+       return FALSE;
+   }
+   else if(conn->http_negotiate_state != GSS_AUTHNONE) {
+@@ -1255,7 +1261,9 @@ static bool url_match_auth_nego(struct connectdata *conn,
+     if(Curl_timestrcmp(m->needle->http_proxy.user,
+                        conn->http_proxy.user) ||
+        Curl_timestrcmp(m->needle->http_proxy.passwd,
+-                       conn->http_proxy.passwd))
++                       conn->http_proxy.passwd) ||
++       Curl_timestrcmp(m->needle->proxy_sasl_service,
++                       conn->proxy_sasl_service))
+       return FALSE;
+   }
+   else if(conn->proxy_negotiate_state != GSS_AUTHNONE) {
+@@ -3596,6 +3604,25 @@ static CURLcode create_conn(struct Curl_easy *data,
+     }
+   }
+ 
++  if(data->set.str[STRING_SERVICE_NAME]) {
++    conn->sasl_service = strdup(data->set.str[STRING_SERVICE_NAME]);
++    if(!conn->sasl_service) {
++      result = CURLE_OUT_OF_MEMORY;
++      goto out;
++    }
++  }
++
++#ifndef CURL_DISABLE_PROXY
++  if(data->set.str[STRING_PROXY_SERVICE_NAME]) {
++    conn->proxy_sasl_service =
++      strdup(data->set.str[STRING_PROXY_SERVICE_NAME]);
++    if(!conn->proxy_sasl_service) {
++      result = CURLE_OUT_OF_MEMORY;
++      goto out;
++    }
++  }
++#endif
++
+ #ifdef USE_UNIX_SOCKETS
+   if(data->set.str[STRING_UNIX_SOCKET_PATH]) {
+     conn->unix_domain_socket = strdup(data->set.str[STRING_UNIX_SOCKET_PATH]);
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 95f2efc55e..12883b86c0 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -687,6 +687,8 @@ struct connectdata {
+   char *options; /* options string, allocated */
+   char *sasl_authzid;     /* authorization identity string, allocated */
+   char *oauth_bearer; /* OAUTH2 bearer, allocated */
++  char *sasl_service; /* SASL service name for auth, allocated */
++  char *proxy_sasl_service; /* SASL service name for proxy auth, allocated */
+   struct curltime created; /* creation time */
+   struct curltime lastused; /* when returned to the connection poolas idle */
+   curl_socket_t sock[2]; /* two sockets, the second is used for the data
+-- 
+2.55.0
+

diff --git a/curl.spec b/curl.spec
index 26302fd..ca2932c 100644
--- a/curl.spec
+++ b/curl.spec
@@ -76,6 +76,9 @@ Patch019: 0019-curl-8.15.0-CVE-2026-10536.patch
 # fix stale proxy password leak (CVE-2026-9079)
 Patch020: 0020-curl-8.15.0-CVE-2026-9079.patch
 
+# fix wrong reuse for different services (CVE-2026-8458)
+Patch021: 0021-curl-8.15.0-CVE-2026-8458.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -481,6 +484,7 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/wcurl.1*
 * Tue Sep 08 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-10
 - fix HTTP/2 stream-dependency tree UAF (CVE-2026-10536)
 - fix stale proxy password leak (CVE-2026-9079)
+- fix wrong reuse for different services (CVE-2026-8458)
 
 * Wed Aug 26 2026 Jan Macku <jamacku@redhat.com> - 8.15.0-9
 - fix proto-default skips SSH verification (CVE-2026-12064)