[Deepin Integration]~[v25-Release] fix(cve): CVE-2026-19931 - Negotiate ambient user connection reuse by deepin-ci-robot@deepin-community/curl by deepin-community-ci-bot[bot] #14216

Package information | 软件包信息

Package repository address | 软件包仓库地址

deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-4686/testing/ ./

Changelog | 更新信息

curl (8.14.1-2+deb13u4deepin20) unstable; urgency=medium

• fix(cve): CVE-2026-19931 - Negotiate ambient user connection reuse
  Backport of the upstream fix (7103a93b05, building on 1a17959fc7) to the
  8.14.1 code base, plus the CURLOPT_USERNAME ambient user documentation
  (c23bc84be4). Replaces the previous verbatim copy of the 8.22.0-DEV
  commit, which does not compile on 8.14.1.

• fix(cve): CVE-2026-87865 (unknown) - libssh2: match hashed
  known_hosts entries by host Upstream:
  curl/curl@323c184
  e1588149

• fix(cve): CVE-2026-92387 (unknown) - pingpong: add a max loop
  counter for Curl_pp_readresp Upstream:
  curl/curl@753735a
  bc5fd5db

• fix(cve): CVE-2026-86410 (unknown) - config2setopts: always set the
  security options for SCP/SFTP Upstream:
  curl/curl@6ae9bef
  9fe1f52c

• fix(cve): CVE-2026-107928 (unknown) - gnutls: hardening Upstream:
  curl/curl@64fb3e7
  2d4a7651

• fix(cve): CVE-2026-87862 (unknown) - hsts: on load, only remove
  exact duplicates Upstream:
  curl/curl@a1614c3
  97a5429c

• fix(cve): CVE-2026-92386 (unknown) - cookie: accept slightly longer
  lines in cookie jars Upstream:
  curl/curl@445aa87
  924e1765

• fix(cve): CVE-2026-87866 (unknown) - x509: stricter parsing
  Upstream:
  curl/curl@ed13174
  c8acba44

• fix(cve): CVE-2026-87864 (unknown) - imap: APPEND CRLF fix
  Upstream:
  curl/curl@3b547de
  70793a66

• fix(cve): CVE-2026-92390 (unknown) - tool: buffer headers before
  remote filename selection Upstream:
  curl/curl@c24a69d
  0a31d5a7

• fix(cve): CVE-2026-86409 (unknown) - setopt: make NULL
  CURLOPT_AWS_SIGV4 disable aws-sigv4 auth Upstream:
  curl/curl@c3c7044
  bc614f24

• fix(cve): CVE-2026-87863 (unknown) - hsts: cap max-age to two years
  Upstream:
  curl/curl@08d50a7
  5501c67e

• fix(cve): CVE-2026-94266 (unknown) - getinfo: make sure
  CURLINFO_EFFECTIVE_URL does not contain creds Upstream:
  curl/curl@7a6bd02
  0cc29f19.patch

• fix(cve): CVE-2026-107929 (unknown) - url: CURLOPT_INTERFACE fix
  connection reuse match Upstream:
  curl/curl@d37d79d
  dad3edba

• fix(cve): CVE-2026-86414 (unknown) - HTTP-CONNECT: do not react to
  401 responses Upstream:
  curl/curl@2956af6
  1f930d52

• fix(cve): CVE-2026-92389 (unknown) - tftp: verify direction in a few
  places Upstream:
  curl/curl@63dd390
  43ebc4e9

• fix(cve): CVE-2026-87865 - adapt the hashed known_hosts host match to
  the 8.14.1 code base (no Curl_peer origin member; match on
  conn->host.name and conn->remote_port)

• fix(cve): CVE-2026-86414 - adapt the tunnel-401 regression test to the
  8.14.1 code base (testutil.pm CRLF conversion for CONNECT, LF header
  echo in test2173, CURLE_RECV_ERROR 56 on failed proxy tunnel)

• fix(cve): CVE-2026-13608 (unknown) - [PATCH] openldap: handle
  Curl_sasl_continue() returns better Upstream:
  curl/curl@ea71c3b
  c8199519

• fix(cve): CVE-2026-80255 (unknown) - [PATCH] cookie: improve TAB
  handling Upstream:
  curl/curl@4f6aa41
  d350aa0a

• fix(cve): CVE-2026-80229 (unknown) - openssl: avoid conn reuse if
  provider is used Upstream:
  curl/curl@7ea37ab
  cf1506bb

• fix(cve): CVE-2026-18924 (unknown) - http2: make server push
  transfers inherit share from parent Upstream:
  curl/curl@90325ff
  0bb6ee43

• fix(cve): CVE-2026-82209 (unknown) - cookie: cookies set for an
  exact PSL domain is host-only Upstream:
  curl/curl@95c1e89
  36e31cd6.patch

• fix(cve): CVE-2026-92388 (unknown) - ftplistparser: no more overwriting
  set.write_func (FTP 通配符 LIST 解析不再改写应用写回调，失败路径也不会
  残留被替换的回调，避免后续传输内存破坏) Upstream:
  curl/curl@ba8f8a7
  93559163e

• fix(cve): CVE-2026-92392 (unknown) - multi: adjust the cleanup order
  in multi_done Upstream:
  curl/curl@8b0744a
  5ad5a321.patch

• fix(cve): CVE-2026-92391 (unknown) - mime: make curl_mime_free non-
  recursive to avoid stack overflow Upstream:
  curl/curl@d754680
  f6f0d344