Debian Patches

Status for curl/8.14.1-2+deb13u4

Patch Description Author Forwarded Bugs Origin Last update
CVE-2026-6276.patch urldata: move cookiehost to struct SingleRequest
To make it scoped for the single request appropriately.


Verify with libtest 2504: a custom Host *disabled* on reused handle

Closes #21312

* lib/http.c: upstream refactored the relevant code into a separate
http_set_aptr_host() function; in 8.14.1 the equivalent code is
still inline in http_host(). Apply the same logic (free the new
per-request field, store the parsed Host into req.cookiehost
instead of aptr.cookiehost, read from the new location in the two
cookie lookup sites).
* lib/request.c, lib/request.h: upstream's struct SingleRequest in
the patch context has userpwd / proxyuserpwd fields not present in
8.14.1; place the new cookiehost field and its Curl_safefree() call
accordingly. Use Curl_safefree (8.14.1) rather than upstream's
curlx_safefree, which does not exist in this version.
* lib/url.c, lib/urldata.h: applied as upstream, modulo Curl_safefree
vs curlx_safefree.
* tests/data/test2504: regression test from upstream, with
crlf="headers" -> crlf="yes" so the 8.14.1 test runner (which only
recognises crlf="yes") correctly converts header newlines on both
the server-side data and the expected protocol block.
* tests/libtest/lib2504.c: rewritten to use the 8.14.1 libtest
harness (test.h / CURLcode test(char *URL) / easy_init /
test_setopt / goto test_cleanup) instead of upstream's newer
first.h-based harness. Test logic is identical.		 Daniel Stenberg <daniel@haxx.se> no 2026-04-14
CVE-2026-7168.patch setopt: clear proxy auth properties when switching
Verify with test 1588

Closes #21453

* lib/setopt.c: upstream's CURLOPT_PROXY case lives in a dedicated
setopt_cptr_proxy() function; in 8.14.1 it is still inline in the
setopt_cptr() switch. The setproxy() helper is added directly
above setopt_cptr() and the inline Curl_setstropt() call is
swapped for setproxy().
* lib/vauth/vauth.h: upstream's hunk also adds a no-op
Curl_auth_is_digest_supported() macro to the CURL_DISABLE_DIGEST_AUTH
branch, but our 8.14.1 vauth.h has no such #else branch (the file
ends the digest block with a bare #endif). Add only the
Curl_auth_digest_cleanup(x) no-op macro inside a new #else, which
is the part actually needed by setproxy() in disable-digest builds.
* tests/data/test1588: regression test from upstream with two changes:
crlf="headers" -> crlf="yes" so the 8.14.1 test runner correctly
applies CRLF to header lines on both the server-side data and the
expected protocol block; and the "digest" entry in <features> is
dropped because the 8.14.1 curlinfo emits the feature toggle as
"digest-auth" rather than "digest", so the unmodified feature gate
would always SKIP the test on this branch. Other digest-auth tests
(e.g. test1061) similarly do not list "digest" as a required
feature.
* tests/libtest/lib1588.c: rewritten to use the 8.14.1 libtest
harness (test.h / CURLcode test(char *URL) / easy_init / easy_setopt
with goto test_cleanup) instead of upstream's newer first.h-based
one. The init1588() helper also reuses the parent's test_cleanup
label rather than upstream's separate init_failed label, since
8.14.1's easy_setopt jumps directly to test_cleanup.		 Daniel Stenberg <daniel@haxx.se> no 2026-04-27
wcurl-CVE-2025-11563.patch Don't percent-decode '/' and '\' in output file name

* Modify wcurl patch to apply on curl sources by changing the location of the
wcurl script from wcurl to scripts/wcurl.
* Drop changes to wcurl's tests as they are not in the curl sources.
* Swap placement of logical AND (&&) operator in conditions of the if
statement to match the new approach; i.e.; they are written in the beginning
of the line instead of the end now.
* Pull fix from https://github.com/curl/wcurl/pull/75, prefixing values
in UNSAFE_PERCENT_ENCODE with "%".		 Samuel Henrique <samueloph@debian.org> no 2025-10-12
CVE-2026-6253.patch http: clear the proxy credentials as well on port or scheme change

Add tests 2009-2011 to verify switching between proxies with credentials
when the switch is driven by a redirect


Closes #21304

* Refresh patch context for lib/http.c, lib/transfer.c and
lib/transfer.h.
* Carry the new tests/data/test2009-2011 from upstream verbatim
here; further test-runner-compatibility tweaks (crlf="headers"
-> crlf="yes", --follow -> --location, expected exit code) were also
applied.		 Daniel Stenberg <daniel@haxx.se> no 2026-04-13
CVE-2026-5773.patch protocol: disable connection reuse for SMB(S)
Connections should only be reused when using the same "share" (and
perhaps some additional conditions), but instead of fixing this flaw,
this change completely disables connection reuse for SMB. This protocol
is about to get dropped soon anyway.

Closes #21238

* Upstream removes PROTOPT_CONN_REUSE from the SMB and SMBS scheme
registrations in lib/protocol.c. That flag (and the lib/protocol.c scheme
registry itself) only exists from upstream commit
feea96851230c7a5a11feaffa0a5e4a4d30e5e63 ("conncontrol: reuse handling", Nov
2025) onward, so neither is present in 8.14.1. In 8.14.1 SMB connection
reuse is instead controlled at runtime via connkeep() / connclose(), and
lib/smb.c explicitly calls connkeep() in smb_connect() to mark SMB
connections as eligible for reuse. Replace that connkeep() with a
connclose() so SMB connections are marked as not-reusable, achieving the
same effect as the upstream change.		 Daniel Stenberg <daniel@haxx.se> no 2026-04-05
CVE-2025-13034.patch vquic-tls/gnutls: call Curl_gtls_verifyserver unconditionally

Closes #19531

[PATCH] When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey`
with the curl tool, curl should check the public key of the server certificate to
verify the peer. This check was skipped in a certain condition that would then make
curl allow the connection without performing the proper check, thus not noticing a
possible impostor. To skip this check, the connection had to be done with QUIC with
ngtcp2 built to use GnuTLS and the user had to explicitly disable the standard
certificate verification.

* removes host verification so that it always verifies.		 Daniel Stenberg <daniel@haxx.se> no backport, https://github.com/curl/curl/commit/3d91ca8cdb3b434226e743946d428b4dd3acf2c9 2026-01-29
CVE-2025-14524.patch curl_sasl: if redirected, require permission to use bearer
Closes #19933

* Refresh patch context for lib/curl_sasl.c		 Daniel Stenberg <daniel@haxx.se> no 2025-12-10
CVE-2025-14819.patch openssl: toggling CURLSSLOPT_NO_PARTIALCHAIN makes a different CA cache


Closes #20009

* Refresh patch context for lib/vtls/openssl.c		 Daniel Stenberg <daniel@haxx.se> no 2025-12-17
CVE-2026-1965_1.patch url: fix reuse of connections using HTTP Negotiate
Assume Negotiate means connection-based

Closes #20534

* Refresh patch context for lib/url.c
* Swap needle->scheme->protocol with needle->handler->protocol,
upstream changed it after the release we ship, at:
https://github.com/curl/curl/commit/8edc0338f30f458f812f9ea355de1240771fa343.		 Daniel Stenberg <daniel@haxx.se> no 2026-02-05
CVE-2026-1965_2.patch url: fix copy and paste url_match_auth_nego mistake
Follow-up to 34fa034
Closes #20662

* Refresh patch context for lib/url.c		 Daniel Stenberg <daniel@haxx.se> no 2026-02-21
CVE-2026-3783.patch http: only send bearer if auth is allowed
Verify with test 2006

Closes #20843

* Refresh patch context for lib/http.c
* Adapt the new tests/data/test2006: reuse the
existing test486 as the base (similarity-copy in the diff), keep the
test definition structurally as upstream wants but also drop the two
now-stale "#" comment lines that already differ between upstream's and
our test486.		 Daniel Stenberg <daniel@haxx.se> no 2026-03-06
CVE-2026-3784.patch proxy-auth: additional tests
Also eliminate the special handling for socks proxy match.

Closes #20837

* Refresh patch context for lib/url.c		 Stefan Eissing <stefan@eissing.org> no 2026-03-06
CVE-2026-3805.patch smb: free the path in the request struct properly
Closes #20854

* Refresh patch context for lib/smb.c		 Stefan Eissing <stefan@eissing.org> no 2026-03-08
CVE-2026-4873.patch url: do not reuse a non-tls starttls connection if new requires TLS


Closes #21082

* Refresh patch context for lib/url.c		 Daniel Stenberg <daniel@haxx.se> no 2026-03-24
CVE-2026-5545.patch url: improve connection reuse on negotiate
Check state of negotiate to allow proper connection reuse.

Closes #21203

* Refresh patch context for lib/url.c		 Stefan Eissing <stefan@eissing.org> no 2026-04-02
ZZZgnutls-build.patch Build with GnuTLS. Steve McIntyre <93sam@debian.org> not-needed vendor 2024-11-06
build-Divide-mit-krb5-gssapi-link-flags-between-LDFLAGS-a.patch build: Divide mit-krb5-gssapi link flags between LDFLAGS and LIBS
From the comments nearby about not having --libs-only-L, it looks as
though the intention was to apply a split like this to all dependency
libraries where possible, and the only reason it was not done for
Kerberos is that krb5-config doesn't have that feature and pkg-config
was originally not supported here. For example, zlib, libssh and librtmp
all have their flags from pkg-config split in this way.

Now that pkg-config is supported here, we can do the intended split.		 Simon McVittie <smcv@collabora.com> no 2022-11-22
11_omit-directories-from-config.patch Omit directories embedding arch info from curl-config
In order to (partially) multi-arch-ify curl-config, remove all
mention of @includedir@ and @libdir@ from the script. On Debian, the actual
header and library directories are architecture-dependent, but will always be
in the C compiler's default search path, so -I and -L options are not
necessary (and may be harmful in multi-arch environments.)		 Benjamin Moody <benjamin.moody@gmail.com> not-needed debian vendor 2025-02-05
tool_getparam_fix_ftp_pasv.patch tool_getparam: fix --ftp-pasv
This boolean option was moved to the wrong handling function. Make it
an ARG_NONE and move it to the correct handler and add a test to
verify that the option works.

Follow-up to 698491f44

Fixes #17545
Closes #17547		 Dan Fandrich <dan@coneharvesters.com> no 2025-06-06
curl_path_make_SFTP_handle_a_path.patch curl_path: make SFTP handle a path like /~ properly.
... without a trailing slash.

Fixes #17534
Closes #17542		 Carlos Henrique Lima Melara <charlesmelara@riseup.net> no 2025-06-05
tool_operate_fix_return_code_when_retry_is_used_but_not_triggered.patch tool_operate: fix return code when --retry is used but not triggered

Verify with test 752

Fixes #17554
Closes #17559		 Daniel Stenberg <daniel@haxx.se> no 2025-06-09
cookie-don-t-treat-the-leading-slash-as-trailing.patch cookie: don't treat the leading slash as trailing
If there is only a leading slash in the path, keep that. Also add an
assert to make sure the path is never blank.

Closes #18266		 Daniel Stenberg <daniel@haxx.se> no 2025-08-11
CVE-2025-10148.patch ws: get a new mask for each new outgoing frame
Closes #18496

Changes:
* Refresh patch context for lib/ws.c
* Adapt return value to current function return type		 Daniel Stenberg <daniel@haxx.se> no 2025-09-08
wcurl-Set-CURL_OPTIONS-right-before-the-url.patch Set CURL_OPTIONS right before the url
I'm reordering the parameters used in the curl invocation to have
"CURL-OPTIONS" be set for last, allowing "--output" to also be
overwritten and making the curl invocation more clear, as having
"--continue-at -" not right before the URL looks weird.

As far as my tests went, this has no functionality side effect other
than allowing "output" to be set by the user.

* Modify wcurl patch to apply on curl sources by changing the location of the
wcurl script from wcurl to scripts/wcurl.		 Samuel Henrique <samueloph@debian.org> no 2025-09-21
wcurl-Fix-example-for-continue-at.patch Fix example for "continue-at"
It stopped working after we introduced the "--no-clobber" option, to
make the example work again we just need to explicitly override it with
"--clobber".

Thanks to Thomas Braun for reporting it.

Closes: https://github.com/curl/wcurl/issues/61


* Modify wcurl patch to apply on curl sources by changing the location of the
wcurl script from wcurl to scripts/wcurl.
* Drop changes to wcurl's README file as they are not in the curl sources.		 Samuel Henrique <samueloph@debian.org> no 2025-09-21
CVE-2026-6429.patch http: clear credentials better on redirect
Verify with test 2506: netrc with redirect using proxy

Updated test 998 which was wrong.


Closes #21345

* lib/http.c: upstream rewrites the relevant block in
Curl_http_follow() entirely, replacing the manual port/scheme
comparison with a Curl_url_same_origin() call against a parsed
copy of data->state.url. Neither Curl_url_same_origin nor the
required Curl_bufref_ptr(&data->state.url) accessor exist in
8.14.1 (state.url is a plain char *). Instead, keep the existing
port/scheme check in place and add the new "no STRING_USERNAME"
case as a short-circuit ahead of it: when no explicit username
was set, force clear=TRUE unconditionally; otherwise fall back
to the historical port/scheme test. Use Curl_safefree (8.14.1)
rather than upstream's curlx_safefree.
* tests/data/test998: drop the now-stale Authorization header line
in the second request of the verify block. Upstream uses the
%b64[alberto:einstein]b64% placeholder while 8.14.1 still has
it pre-encoded as YWxiZXJ0bzplaW5zdGVpbg==; either way the line
needs to go away because the fix now clears those credentials
on the cross-host redirect.
* tests/data/test2506: regression test from upstream, with
crlf="headers" -> crlf="yes" so the 8.14.1 test runner correctly
applies CRLF to header lines on both the server-side data and
the expected protocol block.
* tests/libtest/lib2506.c: rewritten to use the 8.14.1 libtest
harness (test.h / CURLcode test(char *URL) / easy_init /
test_setopt with goto test_cleanup) instead of upstream's newer
first.h-based one. Test logic is identical.		 Daniel Stenberg <daniel@haxx.se> no 2026-04-16

All known versions for source package 'curl'

Links