[AutoPR- Security] Patch curl for CVE-2026-9545 [HIGH]

SPECS/curl/CVE-2026-9545.patch

@@ -0,0 +1,65 @@
+From ec79a18941b27c770edbde430c0157351f985a8b Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 7 Jul 2026 11:04:47 +0000
+Subject: [PATCH] ngtcp2: fail handshake directly
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of None
+---
+ lib/vquic/curl_ngtcp2.c | 25 ++++++++++++++++++++++++-
+ 1 file changed, 24 insertions(+), 1 deletion(-)
+
+diff --git a/lib/vquic/curl_ngtcp2.c b/lib/vquic/curl_ngtcp2.c
+index 37009ab..0ac46cf 100644
+--- a/lib/vquic/curl_ngtcp2.c
++++ b/lib/vquic/curl_ngtcp2.c
+@@ -446,8 +446,25 @@ static CURLcode init_ngh3_conn(struct Curl_cfilter *cf);
+
+ static int cb_handshake_completed(ngtcp2_conn *tconn, void *user_data)
+ {
+-  (void)user_data;
++  struct Curl_cfilter *cf = user_data;
++  struct cf_ngtcp2_ctx *ctx = cf->ctx;
++  struct Curl_easy *data;
+   (void)tconn;
++
++  data = CF_DATA_CURRENT(cf);
++  DEBUGASSERT(data);
++  if(!ctx || !data)
++    return NGTCP2_ERR_CALLBACK_FAILURE;
++
++  ctx->handshake_at = *Curl_pgrs_now(data);
++  ctx->tls_handshake_complete = TRUE;
++  CURL_TRC_CF(data, cf, "handshake complete");
++
++  ctx->tls_vrfy_result = Curl_vquic_tls_verify_peer(&ctx->tls, cf,
++                                                    data, &ctx->peer);
++  if(ctx->tls_vrfy_result)
++    return NGTCP2_ERR_CALLBACK_FAILURE;
++
+   return 0;
+ }
+
+@@ -1275,6 +1292,10 @@ out:
+       nread = -1;
+     }
+   }
++  if(ctx->tls_vrfy_result) {
++    *err = ctx->tls_vrfy_result;
++    nread = -1;
++  }
+   CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] cf_recv(blen=%zu) -> %zd, %d",
+               stream ? stream->id : -1, blen, nread, *err);
+   CF_DATA_RESTORE(cf, save);
+@@ -2393,6 +2414,8 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
+   }
+
+ out:
++  if(ctx->tls_vrfy_result)
++    result = ctx->tls_vrfy_result;
+   if(result == CURLE_RECV_ERROR && ctx->qconn &&
+      ngtcp2_conn_in_draining_period(ctx->qconn)) {
+     /* When a QUIC server instance is shutting down, it may send us a
+-- 
+2.45.4
+

SPECS/curl/curl.spec

@@ -1,7 +1,7 @@
 Summary:        An URL retrieval utility and library
 Name:           curl
 Version:        8.11.1
-Release:        8%{?dist}
+Release:        9%{?dist}
 License:        curl
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -22,6 +22,7 @@ Patch10:        CVE-2026-7168.patch
 Patch11:        CVE-2026-5545.patch
 Patch12:        CVE-2026-6253.patch
 Patch13:        CVE-2026-6429.patch
+Patch14:        CVE-2026-9545.patch
 BuildRequires:  cmake
 BuildRequires:  krb5-devel
 BuildRequires:  libnghttp2-devel
@@ -112,6 +113,9 @@ find %{buildroot} -type f -name "*.la" -delete -print
 %{_libdir}/libcurl.so.*
 
 %changelog
+* Tue Jul 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 8.11.1-9
+- Patch for CVE-2026-9545
+
 * Tue May 26 2026 Jyoti Kanase <v-jykanase@microsoft.com> - 8.11.1-8
 - Patch for CVE-2026-6253, CVE-2026-6429, CVE-2026-5545
 

toolkit/resources/manifests/package/pkggen_core_aarch64.txt

@@ -199,9 +199,9 @@ krb5-1.21.3-5.azl3.aarch64.rpm
 krb5-devel-1.21.3-5.azl3.aarch64.rpm
 nghttp2-1.61.0-3.azl3.aarch64.rpm
 nghttp2-devel-1.61.0-3.azl3.aarch64.rpm
-curl-8.11.1-8.azl3.aarch64.rpm
-curl-devel-8.11.1-8.azl3.aarch64.rpm
-curl-libs-8.11.1-8.azl3.aarch64.rpm
+curl-8.11.1-9.azl3.aarch64.rpm
+curl-devel-8.11.1-9.azl3.aarch64.rpm
+curl-libs-8.11.1-9.azl3.aarch64.rpm
 createrepo_c-1.0.3-1.azl3.aarch64.rpm
 libxml2-2.11.5-9.azl3.aarch64.rpm
 libxml2-devel-2.11.5-9.azl3.aarch64.rpm

toolkit/resources/manifests/package/pkggen_core_x86_64.txt

@@ -199,9 +199,9 @@ krb5-1.21.3-5.azl3.x86_64.rpm
 krb5-devel-1.21.3-5.azl3.x86_64.rpm
 nghttp2-1.61.0-3.azl3.x86_64.rpm
 nghttp2-devel-1.61.0-3.azl3.x86_64.rpm
-curl-8.11.1-8.azl3.x86_64.rpm
-curl-devel-8.11.1-8.azl3.x86_64.rpm
-curl-libs-8.11.1-8.azl3.x86_64.rpm
+curl-8.11.1-9.azl3.x86_64.rpm
+curl-devel-8.11.1-9.azl3.x86_64.rpm
+curl-libs-8.11.1-9.azl3.x86_64.rpm
 createrepo_c-1.0.3-1.azl3.x86_64.rpm
 libxml2-2.11.5-9.azl3.x86_64.rpm
 libxml2-devel-2.11.5-9.azl3.x86_64.rpm

toolkit/resources/manifests/package/toolchain_aarch64.txt

@@ -67,10 +67,10 @@ cracklib-lang-2.9.11-1.azl3.aarch64.rpm
 createrepo_c-1.0.3-1.azl3.aarch64.rpm
 createrepo_c-debuginfo-1.0.3-1.azl3.aarch64.rpm
 createrepo_c-devel-1.0.3-1.azl3.aarch64.rpm
-curl-8.11.1-8.azl3.aarch64.rpm
-curl-debuginfo-8.11.1-8.azl3.aarch64.rpm
-curl-devel-8.11.1-8.azl3.aarch64.rpm
-curl-libs-8.11.1-8.azl3.aarch64.rpm
+curl-8.11.1-9.azl3.aarch64.rpm
+curl-debuginfo-8.11.1-9.azl3.aarch64.rpm
+curl-devel-8.11.1-9.azl3.aarch64.rpm
+curl-libs-8.11.1-9.azl3.aarch64.rpm
 Cython-debuginfo-3.0.5-3.azl3.aarch64.rpm
 debugedit-5.0-2.azl3.aarch64.rpm
 debugedit-debuginfo-5.0-2.azl3.aarch64.rpm

toolkit/resources/manifests/package/toolchain_x86_64.txt

@@ -72,10 +72,10 @@ createrepo_c-debuginfo-1.0.3-1.azl3.x86_64.rpm
 createrepo_c-devel-1.0.3-1.azl3.x86_64.rpm
 cross-binutils-common-2.41-13.azl3.noarch.rpm
 cross-gcc-common-13.2.0-7.azl3.noarch.rpm
-curl-8.11.1-8.azl3.x86_64.rpm
-curl-debuginfo-8.11.1-8.azl3.x86_64.rpm
-curl-devel-8.11.1-8.azl3.x86_64.rpm
-curl-libs-8.11.1-8.azl3.x86_64.rpm
+curl-8.11.1-9.azl3.x86_64.rpm
+curl-debuginfo-8.11.1-9.azl3.x86_64.rpm
+curl-devel-8.11.1-9.azl3.x86_64.rpm
+curl-libs-8.11.1-9.azl3.x86_64.rpm
 Cython-debuginfo-3.0.5-3.azl3.x86_64.rpm
 debugedit-5.0-2.azl3.x86_64.rpm
 debugedit-debuginfo-5.0-2.azl3.x86_64.rpm