Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected]
Control: affects -1 + src:curl
User: [email protected]
Usertags: pu
[ Reason ]
Four Changes. 3 CVE patch backports, and a fix for our CI.
1. Backport of upstream patch for CVE-2026-8286.
In backporting, the changes were mostly context refreshes.
A few variables changed names, and a struct member had been
moved in upstream, and I moved it back.
2. Backport of upstream patch for CVE-2026-8924.
In backporting, I had to cleanup the Makefile, and change
how the test declared usage of crlf line endings.
3. Backport of upstream patch for CVE-2026-8927.
In backporting, the changes were of context refresh,
variable name changes (used in macros),
changes to error codes expected in tests (changed upstream),
changes to crlf line endings in the test,
replace internal libs imports,
removal of a feature gate that does not exists in our version,
and changed where a ifndef block is applied.
4. Additionally, I updated the debian/watch file by cherry-picking
the same file from the debian/sid branch. This does not affect the
package in stable, but fixes our CI pipelines that would otherwise
always fail the "test-uscan" step.
[ Impact ]
The 3 CVEs could affect the user security if exploited by bad actors.
[ Tests ]
The autopkgtests (which run upstreams test suite, including "make
checksrc") pass again with this upload.
All 3 CVEs come with new regression tests added by upstream,
and the tests were backported to work correctly in our version.
[ Risks ]
Low. The 3 patches exists in upstream (and Debian Unstable),
and there is no known regressions involved.
The debian/watch change has no impact at all on the package.
The first two CVEs were almost trivial to backport.
The third (CVE-2026-8927) was a bit more complex, as upstream
changed the orther of some operations. But it is a simple patch.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
* Import upstream patches for 3 CVE fixes:
- CVE-2026-8286
- CVE-2026-8924
- CVE-2026-8927
https://salsa.debian.org/rcpassos/curl/-/commit/c56a3f9967fd1b1638f3592c082f71d3f605916f
* Backport patch CVE-2026-8286
https://salsa.debian.org/rcpassos/curl/-/commit/e6831b59e027e5898f346fe4d0e9ec392001a32a
* Backport patch CVE-2026-8924
https://salsa.debian.org/rcpassos/curl/-/commit/d161f81735b759243747432af4b3e2692d206b19
* Backport patch CVE-2026-8286
https://salsa.debian.org/rcpassos/curl/-/commit/c10983925ac24c2d83afed3931ac36b216689bd9
* Cherry-pick change to debian/watch from debian unstable
https://salsa.debian.org/rcpassos/curl/-/commit/60d871f7d60c0cbca423fe5dab21ff6e33224f0c
[ Other info ]
This is my first backport, but I had the guidance and patience
of Samuel Henrique, who helped me accomplish this PU.
diff -Nru curl-8.14.1/debian/changelog curl-8.14.1/debian/changelog
--- curl-8.14.1/debian/changelog 2026-07-12 18:17:22.000000000 -0300
+++ curl-8.14.1/debian/changelog 2026-07-31 15:47:22.000000000 -0300
@@ -1,3 +1,18 @@
+curl (8.14.1-2+deb13u6) trixie; urgency=medium
+
+ [ Rafael Passos ]
+ * Team upload.
+ * Import upstream patches for 3 CVE fixes:
+ - CVE-2026-8286
+ - CVE-2026-8924
+ - CVE-2026-8927
+
+ [ Samuel Henrique ]
+ * d/watch: Fix regex for release tarball
+ (cherry-pick from debian/sid 116dd318 by Rafael Passos)
+
+ -- Rafael Passos <[email protected]> Fri, 31 Jul 2026 15:47:22 -0300
+
curl (8.14.1-2+deb13u5) trixie; urgency=medium
[ Carlos Henrique Lima Melara ]
diff -Nru curl-8.14.1/debian/patches/CVE-2026-8286.patch
curl-8.14.1/debian/patches/CVE-2026-8286.patch
--- curl-8.14.1/debian/patches/CVE-2026-8286.patch 1969-12-31
21:00:00.000000000 -0300
+++ curl-8.14.1/debian/patches/CVE-2026-8286.patch 2026-07-31
15:47:22.000000000 -0300
@@ -0,0 +1,68 @@
+From: Stefan Eissing <[email protected]>
+Date: Thu, 7 May 2026 10:30:07 +0200
+Subject: [PATCH] url: fix connection reuse for starttls protocols
+
+When a connection is tested for reuse in a transfer that *may* upgrade
+to TLS (commonly via STARTTLS), the SSL configuration must match the
+existing connection.
+
+Reported-by: Andrew Nesbit
+Closes #21522
+
+Backported-by: Rafael Passos <[email protected]>
+ * Refresh patch context for lib/url.c
+ * Changes the flags attribute. Upstream moved
+ protocol and ssl flags into a "scheme" struct
+ member. In our version, its under "handler".
+
+Signed-off-by: Rafael Passos <[email protected]>
+---
+ lib/url.c | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/lib/url.c b/lib/url.c
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -804,7 +804,11 @@ struct url_conn_match {
+ BIT(want_proxy_ntlm_http);
+ BIT(want_nego_http);
+ BIT(want_proxy_nego_http);
+- BIT(req_tls); /* require TLS use from a clear-text start */
++ BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse
++ * connections that have matching TLS configuration.
++ * Always TRUE if `req_tls` is TRUE. */
++ BIT(require_tls); /* Requires TLS use from a clear-text start, can only
++ * reuse connections that have TLS. */
+ BIT(wait_pipe);
+ BIT(force_reuse);
+ BIT(seen_pending_conn);
+@@ -955,7 +959,7 @@ static bool url_match_ssl_use(struct connectdata *conn,
+ if(get_protocol_family(conn->handler) != m->needle->handler->protocol)
+ return FALSE;
+ }
+- else if(m->req_tls)
++ else if(m->require_tls)
+ /* a clear-text STARTTLS protocol with required TLS */
+ return FALSE;
+ return TRUE;
+@@ -1148,8 +1152,8 @@ static bool url_match_destination(struct connectdata
*conn,
+ static bool url_match_ssl_config(struct connectdata *conn,
+ struct url_conn_match *m)
+ {
+- /* If talking TLS, conn needs to use the same SSL options. */
+- if((m->needle->handler->flags & PROTOPT_SSL) &&
++ /* If talking/upgrading to TLS, conn needs to use the same SSL options. */
++ if(((m->needle->handler->flags & PROTOPT_SSL) || m->may_tls) &&
+ !Curl_ssl_conn_config_match(m->data, conn, FALSE)) {
+ DEBUGF(infof(m->data,
+ "Connection #%" FMT_OFF_T
+@@ -1426,7 +1430,8 @@ ConnectionExists(struct Curl_easy *data,
+ (needle->handler->protocol & PROTO_FAMILY_HTTP);
+ #endif
+ #endif
+- match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++ match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
++ match.may_tls = data->set.use_ssl > CURLUSESSL_NONE;
+
+ /* Find a connection in the pool that matches what "data + needle"
+ * requires. If a suitable candidate is found, it is attached to "data". */
diff -Nru curl-8.14.1/debian/patches/CVE-2026-8924.patch
curl-8.14.1/debian/patches/CVE-2026-8924.patch
--- curl-8.14.1/debian/patches/CVE-2026-8924.patch 1969-12-31
21:00:00.000000000 -0300
+++ curl-8.14.1/debian/patches/CVE-2026-8924.patch 2026-07-31
15:47:22.000000000 -0300
@@ -0,0 +1,135 @@
+From: Daniel Stenberg <[email protected]>
+Date: Sat, 16 May 2026 00:19:09 +0200
+Subject: [PATCH] cookie: trim trailing dots when checking PSL
+
+Verified with test 1629
+
+Closes #21636
+
+Backported-by: Rafael Passos <[email protected]>
+ * changes to tests/data/Makefile.am:
+ - new test case test1629,
+ - the upstream patch has more unrelated tests not
+ present in this patch, they had to be removed
+* test1629: replace crlf="headers" -> crlf="yes"
+ so the 8.14.1 test runner correctly applies CRLF to header.
+
+Signed-off-by: Rafael Passos <[email protected]>
+---
+ lib/cookie.c | 13 +++++++++++--
+ tests/data/Makefile.am | 1 +
+ tests/data/{test2504 => test1629} | 29 +++++++++++++++--------------
+ 3 files changed, 27 insertions(+), 16 deletions(-)
+ copy tests/data/{test2504 => test1629} (50%)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index bfdd4ad..062d7aa 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -907,12 +907,21 @@ is_public_suffix(struct Curl_easy *data,
+ char lcookie[256];
+ size_t dlen = strlen(domain);
+ size_t clen = strlen(co->domain);
++
++ /* trim trailing dots */
++ if(dlen && (domain[dlen - 1] == '.'))
++ dlen--;
++ if(clen && (co->domain[clen - 1] == '.'))
++ clen--;
++
+ if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) {
+ const psl_ctx_t *psl = Curl_psl_use(data);
+ if(psl) {
+ /* the PSL check requires lowercase domain name and pattern */
+- Curl_strntolower(lcase, domain, dlen + 1);
+- Curl_strntolower(lcookie, co->domain, clen + 1);
++ Curl_strntolower(lcase, domain, dlen);
++ lcase[dlen] = 0;
++ Curl_strntolower(lcookie, co->domain, clen);
++ lcookie[clen] = 0;
+ acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie);
+ Curl_psl_release(data);
+ }
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 7e4163d..b7e60f7 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -218,6 +218,7 @@ test1608 test1609 test1610 test1611 test1612 test1613
test1614 test1615 \
+ test1616 \
+ test1620 test1621 \
+ \
++test1629 \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
+ \
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
+diff --git a/tests/data/test2504 b/tests/data/test1629
+similarity index 50%
+copy from tests/data/test2504
+copy to tests/data/test1629
+index 704701c..5d9c552 100644
+--- a/tests/data/test2504
++++ b/tests/data/test1629
+@@ -3,36 +3,35 @@
+ <info>
+ <keywords>
+ HTTP
+-cookies
++HTTP GET
+ </keywords>
+ </info>
+
+ # Server-side
+ <reply>
+-<data crlf="yes" nocheck="yes">
++<data crlf="yes">
+ HTTP/1.1 200 OK
+-Date: Tue, 09 Nov 2010 14:49:00 GMT
+-Server: server.example.com
+-Content-Length: 47
+-Set-Cookie: sid=SECRET123; Path=/
++Content-Length: 6
++Set-Cookie: something=1; Domain=co.uk.; Path=/
+
+-file contents should appear once for each file
++-foo-
+ </data>
+ </reply>
+
+ # Client-side
+ <client>
++<features>
++PSL
++cookies
++</features>
+ <server>
+ http
+ </server>
+-<tool>
+-lib%TESTNUMBER
+-</tool>
+ <name>
+-custom Host with cookie, handle reuse, no custom Host:
++cookies with trailing dot after PSL domain
+ </name>
+ <command>
+-http://%HOSTIP:%HTTPPORT
++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve
foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP
+ </command>
+ </client>
+
+@@ -40,11 +39,13 @@ http://%HOSTIP:%HTTPPORT
+ <verify>
+ <protocol crlf="yes">
+ GET / HTTP/1.1
+-Host: victim.internal
++Host: foo.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
+ Accept: */*
+
+ GET / HTTP/1.1
+-Host: %HOSTIP:%HTTPPORT
++Host: bar.co.uk.:%HTTPPORT
++User-Agent: curl/%VERSION
+ Accept: */*
+
+ </protocol>
diff -Nru curl-8.14.1/debian/patches/CVE-2026-8927.patch
curl-8.14.1/debian/patches/CVE-2026-8927.patch
--- curl-8.14.1/debian/patches/CVE-2026-8927.patch 1969-12-31
21:00:00.000000000 -0300
+++ curl-8.14.1/debian/patches/CVE-2026-8927.patch 2026-07-31
15:47:22.000000000 -0300
@@ -0,0 +1,365 @@
+From: Daniel Stenberg <[email protected]>
+Date: Mon, 18 May 2026 23:47:11 +0200
+Subject: [PATCH] url: detect proxy changes read from environment
+
+When a proxy is set from an environment variable, detect if that proxy
+is not the same as previously and flush state.
+
+Verified by test1647: verify changing proxy with env variables and make
+sure Digest state is flushed in the second use
+
+Closes #21666
+
+Backported-by: Rafael Passos <[email protected]>
+ * Refresh patch context for lib/url.c
+ tests/data/Makefile.am
+ tests/libtest/Makefile.inc
+ * Replace lib imports in /tests/libtest/lib1647.c
+ upstream changed the testing tools to a new package.
+ The neede functions are in tesutil.h and test.h.
+ * Updated <proxy> section in test1647 to include the
+ Proxy-Authorization header with the new credentials
+ after proxy change
+ * replace crlf=headers by crlf=yes in test file, add manual
+ crlf termination in test expectation
+ * Change expected error code from 7 to 56 in test1647.
+ This changed in upstream in commit a186ecf4bf, not present
+ in this version. Same as in tests like test217 and test1059
+ * remove the "digest" feature from the test1647, as done
+ in previous backports. This feature gate is not available
+ in this version of curl.
+ * s/result/res/ in /tests/libtest/lib1647.c, this
+ varable is used in macros.
+
+Signed-off-by: Rafael Passos <[email protected]>
+---
+ lib/url.c | 14 ++++++
+ lib/urldata.h | 1 +
+ tests/data/Makefile.am | 1 +
+ tests/data/test1647 | 102 ++++++++++++++++++++++++++++++++++++++
+ tests/libtest/Makefile.inc | 4 ++
+ tests/libtest/lib1647.c | 121 +++++++++++++++++++++++++++++++++++++++++++++
+ 6 files changed, 243 insertions(+)
+ create mode 100644 tests/data/test1647
+ create mode 100644 tests/libtest/lib1647.c
+
+diff --git a/lib/url.c b/lib/url.c
+index 2aa8ce8..5b7c11e 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -100,6 +100,7 @@
+ #include "telnet.h"
+ #include "tftp.h"
+ #include "http.h"
++#include "vauth/vauth.h"
+ #include "http2.h"
+ #include "file.h"
+ #include "curl_ldap.h"
+@@ -339,6 +340,9 @@ CURLcode Curl_close(struct Curl_easy **datap)
+ Curl_freeset(data);
+ Curl_headers_cleanup(data);
+ Curl_netrc_cleanup(&data->state.netrc);
++#ifndef CURL_DISABLE_DIGEST_AUTH
++ free(data->state.envproxy);
++#endif
+ free(data);
+ return CURLE_OK;
+ }
+@@ -2635,6 +2639,16 @@ static CURLcode create_conn_helper_init_proxy(struct
Curl_easy *data,
+ curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype;
+ if(proxy) {
+ result = parse_proxy(data, conn, proxy, ptype);
++ if(!result && conn->http_proxy.host.rawalloc) {
++#ifndef CURL_DISABLE_DIGEST_AUTH
++ if(!Curl_safecmp(data->state.envproxy, proxy)) {
++ /* proxy changed */
++ Curl_auth_digest_cleanup(&data->state.proxydigest);
++ free(data->state.envproxy);
++ data->state.envproxy = strdup(proxy);
++ }
++#endif
++ }
+ Curl_safefree(proxy); /* parse_proxy copies the proxy string */
+ if(result)
+ goto out;
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 4ddb0f7..82526b0 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1147,6 +1147,7 @@ struct UrlState {
+ void (*prev_signal)(int sig);
+ #endif
+ #ifndef CURL_DISABLE_DIGEST_AUTH
++ char *envproxy; /* last proxy string used for proxy-related state */
+ struct digestdata digest; /* state data for host Digest auth */
+ struct digestdata proxydigest; /* state data for proxy Digest auth */
+ #endif
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index b7e60f7..91ba016 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -220,6 +220,7 @@ test1620 test1621 \
+ \
+ test1629 \
+ test1630 test1631 test1632 test1633 test1634 test1635 \
++test1647 \
+ \
+ test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \
+ test1658 \
+diff --git a/tests/data/test1647 b/tests/data/test1647
+new file mode 100644
+index 0000000..d550264
+--- /dev/null
++++ b/tests/data/test1647
+@@ -0,0 +1,102 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++HTTP GET
++HTTP proxy
++HTTP proxy Digest auth
++multi
++</keywords>
++</info>
++
++# Server-side
++<reply>
++
++# this is returned first since we get no proxy-auth
++<data crlf="yes" nocheck="yes">
++HTTP/1.1 407 Authorization Required to proxy me my dear
++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345"
++Content-Length: 33
++
++And you should ignore this data.
++</data>
++
++# then this is returned when we get proxy-auth
++<data1000 crlf="yes">
++HTTP/1.1 200 OK
++Content-Length: 21
++Server: no
++
++Nice proxy auth sir!
++</data1000>
++
++<connect crlf="yes">
++HTTP/1.1 401 OK
++Content-Length: 21
++Server: no
++
++Denied access. Leave
++</connect>
++
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++https-proxy
++https
++</server>
++# tool is what to use instead of 'curl'
++<tool>
++lib%TESTNUMBER
++</tool>
++<features>
++!SSPI
++crypto
++proxy
++Debug
++</features>
++<setenv>
++http_proxy=%HOSTIP:%HTTPPORT
++https_proxy=https://%HOSTIP:%HTTPSPROXYPORT
++CURL_ENTROPY=99376
++</setenv>
++<name>
++HTTP proxy auth Digest, then change proxy with env var and do it again
++</name>
++<command>
++http://test.remote.example.com/path/%TESTNUMBER
https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="yes">
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1
++Host: test.remote.example.com
++Proxy-Authorization: Digest username="daniel", realm="weirdorealm",
nonce="12345", uri="/path/%TESTNUMBER",
response="7a1672891aff03248887b1a6674b8096"
++Accept: */*
++Proxy-Connection: Keep-Alive
++
++</protocol>
++
++<proxy>
++CONNECT another.example.com:%HTTPSPORT HTTP/1.1
++Host: another.example.com:%HTTPSPORT
++Proxy-Connection: Keep-Alive
++
++</proxy>
++
++# CONNECT fails
++<errorcode>
++56
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc
+index 284be0c..8078d78 100644
+--- a/tests/libtest/Makefile.inc
++++ b/tests/libtest/Makefile.inc
+@@ -66,6 +66,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq
\
+ lib1576 lib1578 lib1588 \
+ lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \
+ \
++ lib1647 \
+ lib1662 \
+ \
+ lib1900 lib1901 \
+@@ -566,6 +567,9 @@ lib1597_LDADD = $(TESTUTIL_LIBS)
+ lib1598_SOURCES = lib1598.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib1598_LDADD = $(TESTUTIL_LIBS)
+
++lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
++lib1647_LDADD = $(TESTUTIL_LIBS)
++
+ lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS)
+ lib1662_LDADD = $(TESTUTIL_LIBS)
+
+diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c
+new file mode 100644
+index 0000000..ea11e9c
+--- /dev/null
++++ b/tests/libtest/lib1647.c
+@@ -0,0 +1,121 @@
++/***************************************************************************
++ * _ _ ____ _
++ * Project ___| | | | _ \| |
++ * / __| | | | |_) | |
++ * | (__| |_| | _ <| |___
++ * \___|\___/|_| \_\_____|
++ *
++ * Copyright (C) Daniel Stenberg, <[email protected]>, et al.
++ *
++ * This software is licensed as described in the file COPYING, which
++ * you should have received as part of this distribution. The terms
++ * are also available at https://curl.se/docs/copyright.html.
++ *
++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
++ * copies of the Software, and permit persons to whom the Software is
++ * furnished to do so, under the terms of the COPYING file.
++ *
++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
++ * KIND, either express or implied.
++ *
++ * SPDX-License-Identifier: curl
++ *
++ ***************************************************************************/
++/*
++ * argv1 = the first URL
++ * argv2 = URL2
++ * argv3 = credentials 1
++ * argv4 = credentials 2
++ */
++
++#include "testutil.h"
++#include "test.h"
++
++/* this is meant to pick up the proxy from the environment variable */
++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd)
++{
++ CURLcode res = CURLE_OK;
++
++ res_easy_setopt(curl, CURLOPT_URL, url);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L);
++ if(res)
++ goto init_failed;
++
++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
++ if(res)
++ goto init_failed;
++
++ return CURLE_OK; /* success */
++
++init_failed:
++ return res; /* failure */
++}
++
++static CURLcode run1647(CURL *curl, const char *url, const char *userpwd)
++{
++ CURLcode res = CURLE_OK;
++
++ res = init1647(curl, url, userpwd);
++ if(res)
++ return res;
++
++ return curl_easy_perform(curl);
++}
++
++CURLcode test(char *URL)
++{
++ CURLcode res = CURLE_OK;
++ CURL *curl = NULL;
++
++ res_global_init(CURL_GLOBAL_ALL);
++ if(res)
++ return res;
++
++ curl = curl_easy_init();
++ if(!curl) {
++ curl_mfprintf(stderr, "curl_easy_init() failed\n");
++ curl_global_cleanup();
++ return TEST_ERR_MAJOR_BAD;
++ }
++
++ start_test_timing();
++
++ curl_mprintf("--- First get '%s'\n", URL);
++ res = run1647(curl, URL, libtest_arg3);
++ if(res)
++ goto test_cleanup;
++
++ curl_mprintf("--- Then get '%s'\n", libtest_arg2);
++ res = run1647(curl, libtest_arg2, libtest_arg4);
++
++test_cleanup:
++
++ /* proper cleanup sequence - type PB */
++
++ curl_easy_cleanup(curl);
++ curl_global_cleanup();
++ return res;
++}
diff -Nru curl-8.14.1/debian/patches/series curl-8.14.1/debian/patches/series
--- curl-8.14.1/debian/patches/series 2026-07-12 18:17:22.000000000 -0300
+++ curl-8.14.1/debian/patches/series 2026-07-31 15:47:22.000000000 -0300
@@ -25,3 +25,6 @@
CVE-2026-7168.patch
CVE-2026-6429.patch
openssl_fix_openssl_engines.patch
+CVE-2026-8286.patch
+CVE-2026-8924.patch
+CVE-2026-8927.patch
diff -Nru curl-8.14.1/debian/watch curl-8.14.1/debian/watch
--- curl-8.14.1/debian/watch 2026-07-12 18:17:22.000000000 -0300
+++ curl-8.14.1/debian/watch 2026-07-31 15:47:22.000000000 -0300
@@ -1,3 +1,3 @@
version=4
opts=pgpmode=auto,repacksuffix=+ds \
- https://curl.se/download/ download/curl-([\d\.]+).tar.gz
+ https://curl.se/download/ curl-([\d\.]+).tar.gz
