From ad9557dba535b2b2ad39733c9c3d31851d34a9aa Mon Sep 17 00:00:00 2001 From: Bernd Kuhls Date: Thu, 3 Sep 2026 08:39:13 +0200 Subject: [PATCH] package/libcurl: security bump to version 8.22.0 https://curl.se/ch/8.22.0.html https://daniel.haxx.se/blog/2026/09/02/curl-8-22-0/ Fixes the following CVEs: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80231: native CA store conn reuse CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82208: wolfSSL CA-cache hit overrides callback CVE-2026-82209: domain-scoped PSL domain cookie Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard --- package/libcurl/libcurl.hash | 6 +++--- package/libcurl/libcurl.mk | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package/libcurl/libcurl.hash b/package/libcurl/libcurl.hash index e2393bf2f4..0a7b9e0169 100644 --- a/package/libcurl/libcurl.hash +++ b/package/libcurl/libcurl.hash @@ -1,7 +1,7 @@ -# From https://github.com/curl/curl/releases/tag/curl-8_21_0 +# From https://github.com/curl/curl/releases/tag/curl-8_22_0 # after checking pgp signature: -# https://curl.se/download/curl-8.21.0.tar.xz.asc +# https://curl.se/download/curl-8.22.0.tar.xz.asc # signed with key 27EDEAF22F3ABCEB50DB9A125CC908FDB71E12C2 -sha256 aa1b66a70eace83dc624508745646c08ae561de512ab403adffb93ac87fc72e6 curl-8.21.0.tar.xz +sha256 f7ef3ae8a22e521f289803fe93543eb64c329b58aa73a9e224dfd915a2a5f4f7 curl-8.22.0.tar.xz # Locally computed sha256 82f2f4427d6545ee5aaac4f0b80428da6cc8ba41c2cf5da3a03680ec327b9681 COPYING diff --git a/package/libcurl/libcurl.mk b/package/libcurl/libcurl.mk index 219ce9f712..c3590a8a9e 100644 --- a/package/libcurl/libcurl.mk +++ b/package/libcurl/libcurl.mk @@ -4,7 +4,7 @@ # ################################################################################ -LIBCURL_VERSION = 8.21.0 +LIBCURL_VERSION = 8.22.0 LIBCURL_SOURCE = curl-$(LIBCURL_VERSION).tar.xz LIBCURL_SITE = https://curl.se/download LIBCURL_DEPENDENCIES = host-pkgconf \