Version in base suite: 8.14.1-2+deb13u5 Base version: curl_8.14.1-2+deb13u5 Target version: curl_8.14.1-2+deb13u7 Base file: /srv/ftp-master.debian.org/ftp/pool/main/c/curl/curl_8.14.1-2+deb13u5.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/c/curl/curl_8.14.1-2+deb13u7.dsc changelog | 21 ++ patches/CVE-2026-8286.patch | 68 ++++++++ patches/CVE-2026-8924.patch | 135 +++++++++++++++ patches/CVE-2026-8927.patch | 365 +++++++++++++++++++++++++++++++++++++++++++ patches/CVE-2026-92392.patch | 53 ++++++ patches/series | 4 watch | 2 7 files changed, 647 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpszup5grr/curl_8.14.1-2+deb13u5.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpszup5grr/curl_8.14.1-2+deb13u7.dsc: no acceptable signature found diff -Nru curl-8.14.1/debian/changelog curl-8.14.1/debian/changelog --- curl-8.14.1/debian/changelog 2026-07-12 21:17:22.000000000 +0000 +++ curl-8.14.1/debian/changelog 2026-10-13 04:42:41.000000000 +0000 @@ -1,3 +1,24 @@ +curl (8.14.1-2+deb13u7) trixie-security; urgency=medium + + * Fix CVE-2026-92392 + + -- Samuel Henrique Mon, 12 Oct 2026 21:42:41 -0700 + +curl (8.14.1-2+deb13u6) trixie; urgency=medium + + [ Rafael Passos ] + * Team upload. + * Import upstream patches for 3 CVE fixes: + - CVE-2026-8286 + - CVE-2026-8924 + - CVE-2026-8927 + + [ Samuel Henrique ] + * d/watch: Fix regex for release tarball + (cherry-pick from debian/sid 116dd318 by Rafael Passos) + + -- Rafael Passos Fri, 31 Jul 2026 15:47:22 -0300 + curl (8.14.1-2+deb13u5) trixie; urgency=medium [ Carlos Henrique Lima Melara ] diff -Nru curl-8.14.1/debian/patches/CVE-2026-8286.patch curl-8.14.1/debian/patches/CVE-2026-8286.patch --- curl-8.14.1/debian/patches/CVE-2026-8286.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.14.1/debian/patches/CVE-2026-8286.patch 2026-10-13 04:42:41.000000000 +0000 @@ -0,0 +1,68 @@ +From: Stefan Eissing +Date: Thu, 7 May 2026 10:30:07 +0200 +Subject: [PATCH] url: fix connection reuse for starttls protocols + +When a connection is tested for reuse in a transfer that *may* upgrade +to TLS (commonly via STARTTLS), the SSL configuration must match the +existing connection. + +Reported-by: Andrew Nesbit +Closes #21522 + +Backported-by: Rafael Passos + * Refresh patch context for lib/url.c + * Changes the flags attribute. Upstream moved + protocol and ssl flags into a "scheme" struct + member. In our version, its under "handler". + +Signed-off-by: Rafael Passos +--- + lib/url.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/lib/url.c b/lib/url.c +--- a/lib/url.c ++++ b/lib/url.c +@@ -804,7 +804,11 @@ struct url_conn_match { + BIT(want_proxy_ntlm_http); + BIT(want_nego_http); + BIT(want_proxy_nego_http); +- BIT(req_tls); /* require TLS use from a clear-text start */ ++ BIT(may_tls); /* May upgrade clear-text connection to TLS, can only reuse ++ * connections that have matching TLS configuration. ++ * Always TRUE if `req_tls` is TRUE. */ ++ BIT(require_tls); /* Requires TLS use from a clear-text start, can only ++ * reuse connections that have TLS. */ + BIT(wait_pipe); + BIT(force_reuse); + BIT(seen_pending_conn); +@@ -955,7 +959,7 @@ static bool url_match_ssl_use(struct connectdata *conn, + if(get_protocol_family(conn->handler) != m->needle->handler->protocol) + return FALSE; + } +- else if(m->req_tls) ++ else if(m->require_tls) + /* a clear-text STARTTLS protocol with required TLS */ + return FALSE; + return TRUE; +@@ -1148,8 +1152,8 @@ static bool url_match_destination(struct connectdata *conn, + static bool url_match_ssl_config(struct connectdata *conn, + struct url_conn_match *m) + { +- /* If talking TLS, conn needs to use the same SSL options. */ +- if((m->needle->handler->flags & PROTOPT_SSL) && ++ /* If talking/upgrading to TLS, conn needs to use the same SSL options. */ ++ if(((m->needle->handler->flags & PROTOPT_SSL) || m->may_tls) && + !Curl_ssl_conn_config_match(m->data, conn, FALSE)) { + DEBUGF(infof(m->data, + "Connection #%" FMT_OFF_T +@@ -1426,7 +1430,8 @@ ConnectionExists(struct Curl_easy *data, + (needle->handler->protocol & PROTO_FAMILY_HTTP); + #endif + #endif +- match.req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; ++ match.require_tls = data->set.use_ssl >= CURLUSESSL_CONTROL; ++ match.may_tls = data->set.use_ssl > CURLUSESSL_NONE; + + /* Find a connection in the pool that matches what "data + needle" + * requires. If a suitable candidate is found, it is attached to "data". */ diff -Nru curl-8.14.1/debian/patches/CVE-2026-8924.patch curl-8.14.1/debian/patches/CVE-2026-8924.patch --- curl-8.14.1/debian/patches/CVE-2026-8924.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.14.1/debian/patches/CVE-2026-8924.patch 2026-10-13 04:42:41.000000000 +0000 @@ -0,0 +1,135 @@ +From: Daniel Stenberg +Date: Sat, 16 May 2026 00:19:09 +0200 +Subject: [PATCH] cookie: trim trailing dots when checking PSL + +Verified with test 1629 + +Closes #21636 + +Backported-by: Rafael Passos + * changes to tests/data/Makefile.am: + - new test case test1629, + - the upstream patch has more unrelated tests not + present in this patch, they had to be removed +* test1629: replace crlf="headers" -> crlf="yes" + so the 8.14.1 test runner correctly applies CRLF to header. + +Signed-off-by: Rafael Passos +--- + lib/cookie.c | 13 +++++++++++-- + tests/data/Makefile.am | 1 + + tests/data/{test2504 => test1629} | 29 +++++++++++++++-------------- + 3 files changed, 27 insertions(+), 16 deletions(-) + copy tests/data/{test2504 => test1629} (50%) + +diff --git a/lib/cookie.c b/lib/cookie.c +index bfdd4ad..062d7aa 100644 +--- a/lib/cookie.c ++++ b/lib/cookie.c +@@ -907,12 +907,21 @@ is_public_suffix(struct Curl_easy *data, + char lcookie[256]; + size_t dlen = strlen(domain); + size_t clen = strlen(co->domain); ++ ++ /* trim trailing dots */ ++ if(dlen && (domain[dlen - 1] == '.')) ++ dlen--; ++ if(clen && (co->domain[clen - 1] == '.')) ++ clen--; ++ + if((dlen < sizeof(lcase)) && (clen < sizeof(lcookie))) { + const psl_ctx_t *psl = Curl_psl_use(data); + if(psl) { + /* the PSL check requires lowercase domain name and pattern */ +- Curl_strntolower(lcase, domain, dlen + 1); +- Curl_strntolower(lcookie, co->domain, clen + 1); ++ Curl_strntolower(lcase, domain, dlen); ++ lcase[dlen] = 0; ++ Curl_strntolower(lcookie, co->domain, clen); ++ lcookie[clen] = 0; + acceptable = psl_is_cookie_domain_acceptable(psl, lcase, lcookie); + Curl_psl_release(data); + } +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index 7e4163d..b7e60f7 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -218,6 +218,7 @@ test1608 test1609 test1610 test1611 test1612 test1613 test1614 test1615 \ + test1616 \ + test1620 test1621 \ + \ ++test1629 \ + test1630 test1631 test1632 test1633 test1634 test1635 \ + \ + test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \ +diff --git a/tests/data/test2504 b/tests/data/test1629 +similarity index 50% +copy from tests/data/test2504 +copy to tests/data/test1629 +index 704701c..5d9c552 100644 +--- a/tests/data/test2504 ++++ b/tests/data/test1629 +@@ -3,36 +3,35 @@ + + + HTTP +-cookies ++HTTP GET + + + + # Server-side + +- ++ + HTTP/1.1 200 OK +-Date: Tue, 09 Nov 2010 14:49:00 GMT +-Server: server.example.com +-Content-Length: 47 +-Set-Cookie: sid=SECRET123; Path=/ ++Content-Length: 6 ++Set-Cookie: something=1; Domain=co.uk.; Path=/ + +-file contents should appear once for each file ++-foo- + + + + # Client-side + ++ ++PSL ++cookies ++ + + http + +- +-lib%TESTNUMBER +- + +-custom Host with cookie, handle reuse, no custom Host: ++cookies with trailing dot after PSL domain + + +-http://%HOSTIP:%HTTPPORT ++http://foo.co.uk.:%HTTPPORT/ http://bar.co.uk.:%HTTPPORT/ -b "" --resolve foo.co.uk.:%HTTPPORT:%HOSTIP --resolve bar.co.uk.:%HTTPPORT:%HOSTIP + + + +@@ -40,11 +39,13 @@ http://%HOSTIP:%HTTPPORT + + + GET / HTTP/1.1 +-Host: victim.internal ++Host: foo.co.uk.:%HTTPPORT ++User-Agent: curl/%VERSION + Accept: */* + + GET / HTTP/1.1 +-Host: %HOSTIP:%HTTPPORT ++Host: bar.co.uk.:%HTTPPORT ++User-Agent: curl/%VERSION + Accept: */* + + diff -Nru curl-8.14.1/debian/patches/CVE-2026-8927.patch curl-8.14.1/debian/patches/CVE-2026-8927.patch --- curl-8.14.1/debian/patches/CVE-2026-8927.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.14.1/debian/patches/CVE-2026-8927.patch 2026-10-13 04:42:41.000000000 +0000 @@ -0,0 +1,365 @@ +From: Daniel Stenberg +Date: Mon, 18 May 2026 23:47:11 +0200 +Subject: [PATCH] url: detect proxy changes read from environment + +When a proxy is set from an environment variable, detect if that proxy +is not the same as previously and flush state. + +Verified by test1647: verify changing proxy with env variables and make +sure Digest state is flushed in the second use + +Closes #21666 + +Backported-by: Rafael Passos + * Refresh patch context for lib/url.c + tests/data/Makefile.am + tests/libtest/Makefile.inc + * Replace lib imports in /tests/libtest/lib1647.c + upstream changed the testing tools to a new package. + The neede functions are in tesutil.h and test.h. + * Updated section in test1647 to include the + Proxy-Authorization header with the new credentials + after proxy change + * replace crlf=headers by crlf=yes in test file, add manual + crlf termination in test expectation + * Change expected error code from 7 to 56 in test1647. + This changed in upstream in commit a186ecf4bf, not present + in this version. Same as in tests like test217 and test1059 + * remove the "digest" feature from the test1647, as done + in previous backports. This feature gate is not available + in this version of curl. + * s/result/res/ in /tests/libtest/lib1647.c, this + varable is used in macros. + +Signed-off-by: Rafael Passos +--- + lib/url.c | 14 ++++++ + lib/urldata.h | 1 + + tests/data/Makefile.am | 1 + + tests/data/test1647 | 102 ++++++++++++++++++++++++++++++++++++++ + tests/libtest/Makefile.inc | 4 ++ + tests/libtest/lib1647.c | 121 +++++++++++++++++++++++++++++++++++++++++++++ + 6 files changed, 243 insertions(+) + create mode 100644 tests/data/test1647 + create mode 100644 tests/libtest/lib1647.c + +diff --git a/lib/url.c b/lib/url.c +index 2aa8ce8..5b7c11e 100644 +--- a/lib/url.c ++++ b/lib/url.c +@@ -100,6 +100,7 @@ + #include "telnet.h" + #include "tftp.h" + #include "http.h" ++#include "vauth/vauth.h" + #include "http2.h" + #include "file.h" + #include "curl_ldap.h" +@@ -339,6 +340,9 @@ CURLcode Curl_close(struct Curl_easy **datap) + Curl_freeset(data); + Curl_headers_cleanup(data); + Curl_netrc_cleanup(&data->state.netrc); ++#ifndef CURL_DISABLE_DIGEST_AUTH ++ free(data->state.envproxy); ++#endif + free(data); + return CURLE_OK; + } +@@ -2635,6 +2639,16 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data, + curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype; + if(proxy) { + result = parse_proxy(data, conn, proxy, ptype); ++ if(!result && conn->http_proxy.host.rawalloc) { ++#ifndef CURL_DISABLE_DIGEST_AUTH ++ if(!Curl_safecmp(data->state.envproxy, proxy)) { ++ /* proxy changed */ ++ Curl_auth_digest_cleanup(&data->state.proxydigest); ++ free(data->state.envproxy); ++ data->state.envproxy = strdup(proxy); ++ } ++#endif ++ } + Curl_safefree(proxy); /* parse_proxy copies the proxy string */ + if(result) + goto out; +diff --git a/lib/urldata.h b/lib/urldata.h +index 4ddb0f7..82526b0 100644 +--- a/lib/urldata.h ++++ b/lib/urldata.h +@@ -1147,6 +1147,7 @@ struct UrlState { + void (*prev_signal)(int sig); + #endif + #ifndef CURL_DISABLE_DIGEST_AUTH ++ char *envproxy; /* last proxy string used for proxy-related state */ + struct digestdata digest; /* state data for host Digest auth */ + struct digestdata proxydigest; /* state data for proxy Digest auth */ + #endif +diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am +index b7e60f7..91ba016 100644 +--- a/tests/data/Makefile.am ++++ b/tests/data/Makefile.am +@@ -220,6 +220,7 @@ test1620 test1621 \ + \ + test1629 \ + test1630 test1631 test1632 test1633 test1634 test1635 \ ++test1647 \ + \ + test1650 test1651 test1652 test1653 test1654 test1655 test1656 test1657 \ + test1658 \ +diff --git a/tests/data/test1647 b/tests/data/test1647 +new file mode 100644 +index 0000000..d550264 +--- /dev/null ++++ b/tests/data/test1647 +@@ -0,0 +1,102 @@ ++ ++ ++ ++ ++HTTP ++HTTP GET ++HTTP proxy ++HTTP proxy Digest auth ++multi ++ ++ ++ ++# Server-side ++ ++ ++# this is returned first since we get no proxy-auth ++ ++HTTP/1.1 407 Authorization Required to proxy me my dear ++Proxy-Authenticate: Digest realm="weirdorealm", nonce="12345" ++Content-Length: 33 ++ ++And you should ignore this data. ++ ++ ++# then this is returned when we get proxy-auth ++ ++HTTP/1.1 200 OK ++Content-Length: 21 ++Server: no ++ ++Nice proxy auth sir! ++ ++ ++ ++HTTP/1.1 401 OK ++Content-Length: 21 ++Server: no ++ ++Denied access. Leave ++ ++ ++ ++ ++# Client-side ++ ++ ++http ++https-proxy ++https ++ ++# tool is what to use instead of 'curl' ++ ++lib%TESTNUMBER ++ ++ ++!SSPI ++crypto ++proxy ++Debug ++ ++ ++http_proxy=%HOSTIP:%HTTPPORT ++https_proxy=https://%HOSTIP:%HTTPSPROXYPORT ++CURL_ENTROPY=99376 ++ ++ ++HTTP proxy auth Digest, then change proxy with env var and do it again ++ ++ ++http://test.remote.example.com/path/%TESTNUMBER https://another.example.com:%HTTPSPORT/ daniel:monkey123 another:bump456 ++ ++ ++ ++# Verify data after the test has been "shot" ++ ++ ++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 ++Host: test.remote.example.com ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++GET http://test.remote.example.com/path/%TESTNUMBER HTTP/1.1 ++Host: test.remote.example.com ++Proxy-Authorization: Digest username="daniel", realm="weirdorealm", nonce="12345", uri="/path/%TESTNUMBER", response="7a1672891aff03248887b1a6674b8096" ++Accept: */* ++Proxy-Connection: Keep-Alive ++ ++ ++ ++ ++CONNECT another.example.com:%HTTPSPORT HTTP/1.1 ++Host: another.example.com:%HTTPSPORT ++Proxy-Connection: Keep-Alive ++ ++ ++ ++# CONNECT fails ++ ++56 ++ ++ ++ +diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc +index 284be0c..8078d78 100644 +--- a/tests/libtest/Makefile.inc ++++ b/tests/libtest/Makefile.inc +@@ -66,6 +66,7 @@ LIBTESTPROGS = libauthretry libntlmconnect libprereq \ + lib1576 lib1578 lib1588 \ + lib1591 lib1592 lib1593 lib1594 lib1596 lib1597 lib1598 \ + \ ++ lib1647 \ + lib1662 \ + \ + lib1900 lib1901 \ +@@ -566,6 +567,9 @@ lib1597_LDADD = $(TESTUTIL_LIBS) + lib1598_SOURCES = lib1598.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1598_LDADD = $(TESTUTIL_LIBS) + ++lib1647_SOURCES = lib1647.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) ++lib1647_LDADD = $(TESTUTIL_LIBS) ++ + lib1662_SOURCES = lib1662.c $(SUPPORTFILES) $(TESTUTIL) $(WARNLESS) + lib1662_LDADD = $(TESTUTIL_LIBS) + +diff --git a/tests/libtest/lib1647.c b/tests/libtest/lib1647.c +new file mode 100644 +index 0000000..ea11e9c +--- /dev/null ++++ b/tests/libtest/lib1647.c +@@ -0,0 +1,121 @@ ++/*************************************************************************** ++ * _ _ ____ _ ++ * Project ___| | | | _ \| | ++ * / __| | | | |_) | | ++ * | (__| |_| | _ <| |___ ++ * \___|\___/|_| \_\_____| ++ * ++ * Copyright (C) Daniel Stenberg, , et al. ++ * ++ * This software is licensed as described in the file COPYING, which ++ * you should have received as part of this distribution. The terms ++ * are also available at https://curl.se/docs/copyright.html. ++ * ++ * You may opt to use, copy, modify, merge, publish, distribute and/or sell ++ * copies of the Software, and permit persons to whom the Software is ++ * furnished to do so, under the terms of the COPYING file. ++ * ++ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY ++ * KIND, either express or implied. ++ * ++ * SPDX-License-Identifier: curl ++ * ++ ***************************************************************************/ ++/* ++ * argv1 = the first URL ++ * argv2 = URL2 ++ * argv3 = credentials 1 ++ * argv4 = credentials 2 ++ */ ++ ++#include "testutil.h" ++#include "test.h" ++ ++/* this is meant to pick up the proxy from the environment variable */ ++static CURLcode init1647(CURL *curl, const char *url, const char *userpwd) ++{ ++ CURLcode res = CURLE_OK; ++ ++ res_easy_setopt(curl, CURLOPT_URL, url); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYUSERPWD, userpwd); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXYAUTH, CURLAUTH_DIGEST); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYPEER, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_PROXY_SSL_VERIFYHOST, 0L); ++ if(res) ++ goto init_failed; ++ ++ res_easy_setopt(curl, CURLOPT_VERBOSE, 1L); ++ if(res) ++ goto init_failed; ++ ++ return CURLE_OK; /* success */ ++ ++init_failed: ++ return res; /* failure */ ++} ++ ++static CURLcode run1647(CURL *curl, const char *url, const char *userpwd) ++{ ++ CURLcode res = CURLE_OK; ++ ++ res = init1647(curl, url, userpwd); ++ if(res) ++ return res; ++ ++ return curl_easy_perform(curl); ++} ++ ++CURLcode test(char *URL) ++{ ++ CURLcode res = CURLE_OK; ++ CURL *curl = NULL; ++ ++ res_global_init(CURL_GLOBAL_ALL); ++ if(res) ++ return res; ++ ++ curl = curl_easy_init(); ++ if(!curl) { ++ curl_mfprintf(stderr, "curl_easy_init() failed\n"); ++ curl_global_cleanup(); ++ return TEST_ERR_MAJOR_BAD; ++ } ++ ++ start_test_timing(); ++ ++ curl_mprintf("--- First get '%s'\n", URL); ++ res = run1647(curl, URL, libtest_arg3); ++ if(res) ++ goto test_cleanup; ++ ++ curl_mprintf("--- Then get '%s'\n", libtest_arg2); ++ res = run1647(curl, libtest_arg2, libtest_arg4); ++ ++test_cleanup: ++ ++ /* proper cleanup sequence - type PB */ ++ ++ curl_easy_cleanup(curl); ++ curl_global_cleanup(); ++ return res; ++} diff -Nru curl-8.14.1/debian/patches/CVE-2026-92392.patch curl-8.14.1/debian/patches/CVE-2026-92392.patch --- curl-8.14.1/debian/patches/CVE-2026-92392.patch 1970-01-01 00:00:00.000000000 +0000 +++ curl-8.14.1/debian/patches/CVE-2026-92392.patch 2026-10-13 04:42:41.000000000 +0000 @@ -0,0 +1,53 @@ +From: Stefan Eissing +Date: Mon, 12 Oct 2026 07:40:45 +0200 +Subject: [PATCH] multi: adjust the cleanup order in multi_done + +Closes #23370 + +Backported-by: Samuel Henrique + * lib/multi.c: 8.14.1's multi_done() detaches the connection, prunes the + DNS cache and returns the connection to the pool inside + Curl_cpool_do_locked()/multi_done_locked() instead of upstream's + if(conn) block, so get the same order by moving the existing calls: + - Curl_req_done() before Curl_conn_ev_data_done(); + - Curl_conn_ev_data_done() right before Curl_cpool_do_locked(); + - process_pending_handles(), 8.14.1's name for upstream's + multi_schedule_pending(), after Curl_cpool_do_locked(). + * lib/multi.c: keep calling Curl_conn_ev_data_done() and + process_pending_handles() unconditionally, without upstream's if(conn) + and if(data->multi) checks, as 8.14.1's multi_done() always has a + connection and a multi handle. +--- + lib/multi.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/lib/multi.c b/lib/multi.c +index 64eb1ae85..1d193250f 100644 +--- a/lib/multi.c ++++ b/lib/multi.c +@@ -642,19 +642,20 @@ static CURLcode multi_done(struct Curl_easy *data, + if(r2 && !result) + result = r2; + +- /* Inform connection filters that this transfer is done */ +- Curl_conn_ev_data_done(data, premature); +- +- process_pending_handles(data->multi); /* connection / multiplex */ +- + if(!result) + result = Curl_req_done(&data->req, data, premature); + ++ /* Inform connection filters that this transfer is done and they ++ * need to give up any references to `data`. */ ++ Curl_conn_ev_data_done(data, premature); ++ + /* Under the potential connection pool's share lock, decide what to + * do with the transfer's connection. */ + mdctx.premature = premature; + Curl_cpool_do_locked(data, data->conn, multi_done_locked, &mdctx); + ++ process_pending_handles(data->multi); /* connection / multiplex */ ++ + /* flush the netrc cache */ + Curl_netrc_cleanup(&data->state.netrc); + return result; diff -Nru curl-8.14.1/debian/patches/series curl-8.14.1/debian/patches/series --- curl-8.14.1/debian/patches/series 2026-07-12 21:17:22.000000000 +0000 +++ curl-8.14.1/debian/patches/series 2026-10-13 04:42:41.000000000 +0000 @@ -25,3 +25,7 @@ CVE-2026-7168.patch CVE-2026-6429.patch openssl_fix_openssl_engines.patch +CVE-2026-8286.patch +CVE-2026-8924.patch +CVE-2026-8927.patch +CVE-2026-92392.patch diff -Nru curl-8.14.1/debian/watch curl-8.14.1/debian/watch --- curl-8.14.1/debian/watch 2026-07-12 21:17:22.000000000 +0000 +++ curl-8.14.1/debian/watch 2026-10-13 04:42:41.000000000 +0000 @@ -1,3 +1,3 @@ version=4 opts=pgpmode=auto,repacksuffix=+ds \ - https://curl.se/download/ download/curl-([\d\.]+).tar.gz + https://curl.se/download/ curl-([\d\.]+).tar.gz