From c5366e63b1c62978e672c097e00d267ef67eb91c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jo=C3=A3o=20Marcos=20Costa?= Date: Fri, 24 Jul 2026 10:06:24 +0200 Subject: [PATCH] curl: add annotation for CVE-2026-10536 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This CVE is detailed here: https://curl.se/docs/CVE-2026-10536.html and the fix essentially consolidates the fact that HTTP2 stream dependency is deprecated. While oe-core provides a PACKAGECONFIG to enable HTTP2, it is not actually used so the affected part of the code is not compiled. For instance, in the do_configure logs: """ (...) HTTP2: no (--with-nghttp2, --with-hyper) (...) """ Ignore this CVE unless 'nghttp2' is enabled. (From OE-Core rev: 637ce45a66ff7125b98fc126321b31cb0cf6bf0f) Signed-off-by: João Marcos Costa (Schneider Electric) Signed-off-by: Yoann Congal Signed-off-by: Paul Barker --- meta/recipes-support/curl/curl_8.7.1.bb | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-support/curl/curl_8.7.1.bb b/meta/recipes-support/curl/curl_8.7.1.bb index 276526f01e..3e48c58fa7 100644 --- a/meta/recipes-support/curl/curl_8.7.1.bb +++ b/meta/recipes-support/curl/curl_8.7.1.bb @@ -53,6 +53,7 @@ CVE_STATUS[CVE-2024-32928] = "ignored: CURLOPT_SSL_VERIFYPEER was disabled on go CVE_STATUS[CVE-2025-0725] = "not-applicable-config: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older" CVE_STATUS[CVE-2025-5025] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}" CVE_STATUS[CVE-2025-10966] = "${@bb.utils.contains('PACKAGECONFIG', 'openssl', 'not-applicable-config: applicable only with wolfssl','unpatched',d)}" +CVE_STATUS[CVE-2026-10536] = "${@bb.utils.contains('PACKAGECONFIG', 'nghttp2', 'unpatched', 'not-applicable-config: applicable only with HTTP/2', d)}" inherit autotools pkgconfig binconfig multilib_header ptest