azurelinux-security · azurelinux-security · Jul 6, 2026
diff --git a/base/comps/curl/CVE-2026-12064.patch b/base/comps/curl/CVE-2026-12064.patch
@@ -0,0 +1,278 @@
+From 97c239fba29744a73385a1748a72203d50719bc9 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 6 Jul 2026 03:26:08 +0000
+Subject: [PATCH] config2setopts: use default protocol properly
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference AI Backport of: https://github.com/curl/curl/commit/ab3bb8cd8be8f9d4acb97da041.patch
+---
+ docs/cmdline-opts/proto-default.md | 37 +++++++++++++--------
+ src/config2setopts.c               | 41 ++++++++++++++++-------
+ tests/data/Makefile.am             |  2 +-
+ tests/data/test1724                | 53 ++++++++++++++++++++++++++++++
+ tests/data/test1725                | 29 ++++++++++++++++
+ tests/data/test2036                | 26 +++++++++++++++
+ 6 files changed, 162 insertions(+), 26 deletions(-)
+ create mode 100644 tests/data/test1724
+ create mode 100644 tests/data/test1725
+ create mode 100644 tests/data/test2036
+
+diff --git a/docs/cmdline-opts/proto-default.md b/docs/cmdline-opts/proto-default.md
+index 209e5cd..08005f2 100644
+--- a/docs/cmdline-opts/proto-default.md
++++ b/docs/cmdline-opts/proto-default.md
+@@ -1,22 +1,30 @@
++<!--
++Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
++
++SPDX-License-Identifier: curl
++-->
++
+ ---
+ c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ SPDX-License-Identifier: curl
+-Long: proto-default
+-Help: Use PROTOCOL for any URL missing a scheme
+-Arg: <protocol>
+-Added: 7.45.0
+-Category: connection curl
+-Multi: single
+-See-also:
+-  - proto
+-  - proto-redir
+-Example:
+-  - --proto-default https ftp.example.com
++Title: --proto-default
++Section: 3
+ ---
+
+-# `--proto-default`
++# NAME
++
++proto-default - set default protocol
+
+-Use *protocol* for any provided URL missing a scheme.
++# SYNOPSIS
++
++~~~sh
++--proto-default <protocol>
++~~~
++
++# DESCRIPTION
++
++Use *protocol* for any provided URL missing a scheme. The case-insensitive
++name should be given without any `://` suffix.
+
+ An unknown or unsupported protocol causes error *CURLE_UNSUPPORTED_PROTOCOL*.
+
+@@ -24,3 +32,6 @@ This option does not change the default proxy protocol (http).
+
+ Without this option set, curl guesses protocol based on the hostname, see
+ --url for details.
++
++The default protocol cannot be set to `ipfs` or `ipns`. Those schemes need to
++be used explicitly in the URL.
+diff --git a/src/config2setopts.c b/src/config2setopts.c
+index 8e4af65..fd7db06 100644
+--- a/src/config2setopts.c
++++ b/src/config2setopts.c
+@@ -138,15 +138,31 @@ static CURLcode url_proto_and_rewrite(char **url,
+   DEBUGASSERT(url && *url);
+   if(uh) {
+     char *schemep = NULL;
+-    if(!curl_url_set(uh, CURLUPART_URL, *url,
+-                     CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME) &&
+-       !curl_url_get(uh, CURLUPART_SCHEME, &schemep,
+-                     CURLU_DEFAULT_SCHEME)) {
+-#ifdef CURL_DISABLE_IPFS
+-      (void)config;
+-#else
+-      if(curl_strequal(schemep, proto_ipfs) ||
+-         curl_strequal(schemep, proto_ipns)) {
++    CURLUcode uc;
++    uc = curl_url_set(uh, CURLUPART_URL, *url,
++                      CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
++    if(!uc) {
++      if(config->proto_default) {
++        /* when a default proto is requested, do not guess */
++        uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
++                          CURLU_NO_GUESS_SCHEME);
++        if(uc == CURLUE_NO_SCHEME) {
++          /* use the default */
++          proto = proto_token(config->proto_default);
++          if(proto)
++            uc = CURLUE_OK;
++        }
++      }
++      else {
++        uc = curl_url_get(uh, CURLUPART_SCHEME, &schemep,
++                          CURLU_DEFAULT_SCHEME);
++      }
++      if(schemep)
++        proto = proto_token(schemep);
++#ifndef CURL_DISABLE_IPFS
++      if(!uc &&
++         (curl_strequal(schemep, proto_ipfs) ||
++          curl_strequal(schemep, proto_ipns))) {
+         result = ipfs_url_rewrite(uh, schemep, url, config);
+         /* short-circuit proto_token, we know it is ipfs or ipns */
+         if(curl_strequal(schemep, proto_ipfs))
+@@ -156,12 +172,13 @@ static CURLcode url_proto_and_rewrite(char **url,
+         if(result)
+           config->synthetic_error = TRUE;
+       }
+-      else
+ #endif /* !CURL_DISABLE_IPFS */
+-        proto = proto_token(schemep);
+-
++      if(uc == CURLUE_OUT_OF_MEMORY)
++        result = CURLE_OUT_OF_MEMORY;
+       curl_free(schemep);
+     }
++    else if(uc == CURLUE_OUT_OF_MEMORY)
++      result = CURLE_OUT_OF_MEMORY;
+     curl_url_cleanup(uh);
+   }
+   else
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 7d8e8c7..d78e87b 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -244,7 +244,7 @@ test2000 test2001 test2002 test2003 test2004 test2005 \
+ \
+                                                                test2023 \
+ test2024 test2025 test2026 test2027 test2028 test2029 test2030 test2031 \
+-test2032 test2033 test2034 test2035          test2037 test2038 test2039 \
++test2032 test2033 test2034 test2035 test2036 test2037 test2038 test2039 \
+ test2040 test2041 test2042 test2043 test2044 test2045 test2046 test2047 \
+ test2048 test2049 test2050 test2051 test2052 test2053 test2054 test2055 \
+ test2056 test2057 test2058 test2059 test2060 test2061 test2062 test2063 \
+diff --git a/tests/data/test1724 b/tests/data/test1724
+new file mode 100644
+index 0000000..3cd328e
+--- /dev/null
++++ b/tests/data/test1724
+@@ -0,0 +1,53 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++IPFS
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data nocheck="yes">
++HTTP/1.1 200 OK
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Server: test-server/fake
++Last-Modified: Tue, 13 Jun 2000 12:10:00 GMT
++ETag: "21025-dc7-39462498"
++Accept-Ranges: bytes
++Content-Length: 21
++Connection: close
++Content-Type: text/plain
++Funny-head: yesyes
++
++Hello curl from IPFS
++</data>
++</reply>
++
++# Client-side
++<client>
++<features>
++ipfs
++</features>
++<server>
++http
++</server>
++<name>
++IPFS with --proto-default HTTP
++</name>
++<command>
++--ipfs-gateway http://%HOSTIP:%HTTPPORT ipfs://bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u --proto-default http
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET /ipfs/bafybeidecnvkrygux6uoukouzps5ofkeevoqland7kopseiod6pzqvjg7u HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++</verify>
++</testcase>
+diff --git a/tests/data/test1725 b/tests/data/test1725
+new file mode 100644
+index 0000000..2a882c7
+--- /dev/null
++++ b/tests/data/test1725
+@@ -0,0 +1,29 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++SCP
++server key check
++</keywords>
++</info>
++
++# Client-side
++<client>
++<server>
++scp
++</server>
++<name>
++SCP incorrect host key with --proto-default SCP
++</name>
++<command>
++--hostpubmd5 00000000000000000000000000000000 --key %LOGDIR/server/curl_client_key --pubkey %LOGDIR/server/curl_client_key.pub -u %USER: %HOSTIP:%SSHPORT%SCP_PWD/%LOGDIR/irrelevant-file --insecure --proto-default SCP
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<errorcode>
++60
++</errorcode>
++</verify>
++</testcase>
+diff --git a/tests/data/test2036 b/tests/data/test2036
+new file mode 100644
+index 0000000..b017a71
+--- /dev/null
++++ b/tests/data/test2036
+@@ -0,0 +1,26 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++--proto-default
++</keywords>
++</info>
++
++# Client-side
++<client>
++<name>
++Attempt to set a default protocol with :// suffix
++</name>
++<command>
++--proto-default https://
++</command>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++# CURLE_UNSUPPORTED_PROTOCOL is error code 1
++<errorcode>
++1
++</errorcode>
++</verify>
++</testcase>
+-- 
+2.45.4
+