Merge PR "[AUTO-CHERRYPICK] [AutoPR- Security] Patch curl for CVE-2026-8932, CVE-2026-8927, CVE-2026-8926, CVE-2026-12064, CVE-2026-8458, CVE-2026-9079, CVE-2026-8286, CVE-2026-10536 [CRITICAL] - branch 3.0-dev" #17991

Co-authored-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Co-authored-by: Akarsh Chaudhary <v-akarshc@microsoft.com>

Author: 3 people

SPECS/curl/CVE-2026-10536.patch

@@ -0,0 +1,339 @@
+From 58384112815014d94d5b35ddbe4b96b033224b81 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Wed, 8 Jul 2026 11:01:50 +0000
+Subject: [PATCH] http2: remove stream dependency tracking
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/curl/curl/commit/bfbff7852f050232edd3e5ca.patch
+---
+ docs/libcurl/curl_easy_setopt.md              |    5 +-
+ docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md   |    8 ++
+ docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md |    8 ++
+ docs/libcurl/symbols-in-versions              |    4 +-
+ include/curl/curl.h                           |    6 +-
+ lib/http2.c                                   |   18 ++---
+ lib/setopt.c                                  |    9 +-
+ lib/url.c                                     |   96 -------------------------
+ lib/urldata.h                                 |    8 --
+ 9 files changed, 34 insertions(+), 128 deletions(-)
+
+diff --git a/docs/libcurl/curl_easy_setopt.md b/docs/libcurl/curl_easy_setopt.md
+index e0fe95c..73e240d 100644
+--- a/docs/libcurl/curl_easy_setopt.md
++++ b/docs/libcurl/curl_easy_setopt.md
+@@ -1146,11 +1146,12 @@ Redirect stderr to another stream. See CURLOPT_STDERR(3)
+ 
+ ## CURLOPT_STREAM_DEPENDS
+ 
+-This HTTP/2 stream depends on another. See CURLOPT_STREAM_DEPENDS(3)
++**Deprecated option** This HTTP/2 stream depends on another. See
++CURLOPT_STREAM_DEPENDS(3)
+ 
+ ## CURLOPT_STREAM_DEPENDS_E
+ 
+-This HTTP/2 stream depends on another exclusively. See
++**Deprecated option** This HTTP/2 stream depends on another exclusively. See
+ CURLOPT_STREAM_DEPENDS_E(3)
+ 
+ ## CURLOPT_STREAM_WEIGHT
+diff --git a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
+index 1429de1..4fc90b8 100644
+--- a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
++++ b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS.md
+@@ -44,6 +44,10 @@ an error. It must be another easy handle, and it also needs to be a handle of
+ a transfer that is about to be sent over the same HTTP/2 connection for this
+ option to have an actual effect.
+ 
++Since version 8.21.0 setting this option no longer has an effect. HTTP/2
++stream dependencies were introduced in RFC 7540 and then later deprecated
++in RFC 9113.
++
+ # DEFAULT
+ 
+ NULL
+@@ -69,6 +73,10 @@ int main(void)
+ }
+ ~~~
+ 
++# DEPRECATED
++
++Deprecated since 8.21.0.
++
+ # %AVAILABILITY%
+ 
+ # RETURN VALUE
+diff --git a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
+index bddfead..0e85b72 100644
+--- a/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
++++ b/docs/libcurl/opts/CURLOPT_STREAM_DEPENDS_E.md
+@@ -47,6 +47,10 @@ an error. It must be another easy handle, and it also needs to be a handle of
+ a transfer that is about to be sent over the same HTTP/2 connection for this
+ option to have an actual effect.
+ 
++Since version 8.21.0 setting this option no longer has an effect. HTTP/2
++stream dependencies were introduced in RFC 7540 and then later deprecated
++in RFC 9113.
++
+ # DEFAULT
+ 
+ NULL
+@@ -72,6 +76,10 @@ int main(void)
+ }
+ ~~~
+ 
++# DEPRECATED
++
++Deprecated since 8.21.0.
++
+ # %AVAILABILITY%
+ 
+ # RETURN VALUE
+diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
+index ddda26d..b56527b 100644
+--- a/docs/libcurl/symbols-in-versions
++++ b/docs/libcurl/symbols-in-versions
+@@ -858,8 +858,8 @@ CURLOPT_SSLKEYPASSWD            7.9.3         7.17.0
+ CURLOPT_SSLKEYTYPE              7.9.3
+ CURLOPT_SSLVERSION              7.1
+ CURLOPT_STDERR                  7.1
+-CURLOPT_STREAM_DEPENDS          7.46.0
+-CURLOPT_STREAM_DEPENDS_E        7.46.0
++CURLOPT_STREAM_DEPENDS          7.46.0        8.21.0
++CURLOPT_STREAM_DEPENDS_E        7.46.0        8.21.0
+ CURLOPT_STREAM_WEIGHT           7.46.0
+ CURLOPT_SUPPRESS_CONNECT_HEADERS 7.54.0
+ CURLOPT_TCP_FASTOPEN            7.49.0
+diff --git a/include/curl/curl.h b/include/curl/curl.h
+index 1883558..8e04952 100644
+--- a/include/curl/curl.h
++++ b/include/curl/curl.h
+@@ -1960,10 +1960,12 @@ typedef enum {
+   CURLOPT(CURLOPT_STREAM_WEIGHT, CURLOPTTYPE_LONG, 239),
+ 
+   /* Set stream dependency on another CURL handle */
+-  CURLOPT(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240),
++  CURLOPTDEPRECATED(CURLOPT_STREAM_DEPENDS, CURLOPTTYPE_OBJECTPOINT, 240,
++                    8.21.0, "Has no function"),
+ 
+   /* Set E-xclusive stream dependency on another CURL handle */
+-  CURLOPT(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241),
++  CURLOPTDEPRECATED(CURLOPT_STREAM_DEPENDS_E, CURLOPTTYPE_OBJECTPOINT, 241,
++                    8.21.0, "Has no function"),
+ 
+   /* Do not send any tftp option requests to the server */
+   CURLOPT(CURLOPT_TFTP_NO_OPTIONS, CURLOPTTYPE_LONG, 242),
+diff --git a/lib/http2.c b/lib/http2.c
+index ef29686..2871c3d 100644
+--- a/lib/http2.c
++++ b/lib/http2.c
+@@ -1872,16 +1872,12 @@ static int sweight_in_effect(const struct Curl_easy *data)
+  * struct.
+  */
+ 
+-static void h2_pri_spec(struct cf_h2_ctx *ctx,
+-                        struct Curl_easy *data,
++static void h2_pri_spec(struct Curl_easy *data,
+                         nghttp2_priority_spec *pri_spec)
+ {
+   struct Curl_data_priority *prio = &data->set.priority;
+-  struct h2_stream_ctx *depstream = H2_STREAM_CTX(ctx, prio->parent);
+-  int32_t depstream_id = depstream ? depstream->id : 0;
+-  nghttp2_priority_spec_init(pri_spec, depstream_id,
+-                             sweight_wanted(data),
+-                             data->set.priority.exclusive);
++  nghttp2_priority_spec_init(pri_spec, 0,
++                             sweight_wanted(data), FALSE);
+   data->state.priority = *prio;
+ }
+ 
+@@ -1899,13 +1895,11 @@ static CURLcode h2_progress_egress(struct Curl_cfilter *cf,
+   int rv = 0;
+ 
+   if(stream && stream->id > 0 &&
+-     ((sweight_wanted(data) != sweight_in_effect(data)) ||
+-      (data->set.priority.exclusive != data->state.priority.exclusive) ||
+-      (data->set.priority.parent != data->state.priority.parent)) ) {
++     (sweight_wanted(data) != sweight_in_effect(data))) {
+     /* send new weight and/or dependency */
+     nghttp2_priority_spec pri_spec;
+ 
+-    h2_pri_spec(ctx, data, &pri_spec);
++    h2_pri_spec(data, &pri_spec);
+     CURL_TRC_CF(data, cf, "[%d] Queuing PRIORITY", stream->id);
+     DEBUGASSERT(stream->id != -1);
+     rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
+@@ -2210,7 +2205,7 @@ static ssize_t h2_submit(struct h2_stream_ctx **pstream,
+     goto out;
+   }
+ 
+-  h2_pri_spec(ctx, data, &pri_spec);
++  h2_pri_spec(data, &pri_spec);
+   if(!nghttp2_session_check_request_allowed(ctx->h2))
+     CURL_TRC_CF(data, cf, "send request NOT allowed (via nghttp2)");
+ 
+diff --git a/lib/setopt.c b/lib/setopt.c
+index 1ab0d1e..6b8cbb3 100644
+--- a/lib/setopt.c
++++ b/lib/setopt.c
+@@ -1652,13 +1652,10 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
+ 
+ #ifdef USE_HTTP2
+   case CURLOPT_STREAM_DEPENDS:
+-  case CURLOPT_STREAM_DEPENDS_E: {
+-    struct Curl_easy *dep = va_arg(param, struct Curl_easy *);
+-    if(!dep || GOOD_EASY_HANDLE(dep))
+-      return Curl_data_priority_add_child(dep, data,
+-                                          option == CURLOPT_STREAM_DEPENDS_E);
++  case CURLOPT_STREAM_DEPENDS_E:
++    /* not doing stream dependencies any longer, but accept options
++     * for backward compatibility */
+     break;
+-  }
+ #endif
+ 
+   default:
+diff --git a/lib/url.c b/lib/url.c
+index cd8dbcc..7923485 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -130,12 +130,6 @@
+ #define ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
+ #endif
+ 
+-#ifdef USE_NGHTTP2
+-static void data_priority_cleanup(struct Curl_easy *data);
+-#else
+-#define data_priority_cleanup(x)
+-#endif
+-
+ /* Some parts of the code (e.g. chunked encoding) assume this buffer has at
+  * more than just a few bytes to play with. Do not let it become too small or
+  * bad things will happen.
+@@ -298,7 +292,6 @@ CURLcode Curl_close(struct Curl_easy **datap)
+   Curl_resolver_cancel(data);
+   Curl_resolver_cleanup(data->state.async.resolver);
+ 
+-  data_priority_cleanup(data);
+ 
+   /* No longer a dirty share, if it exists */
+   if(data->share) {
+@@ -3957,96 +3949,7 @@ CURLcode Curl_init_do(struct Curl_easy *data, struct connectdata *conn)
+ 
+ #if defined(USE_HTTP2) || defined(USE_HTTP3)
+ 
+-#ifdef USE_NGHTTP2
+-
+-static void priority_remove_child(struct Curl_easy *parent,
+-                                  struct Curl_easy *child)
+-{
+-  struct Curl_data_prio_node **pnext = &parent->set.priority.children;
+-  struct Curl_data_prio_node *pnode = parent->set.priority.children;
+-
+-  DEBUGASSERT(child->set.priority.parent == parent);
+-  while(pnode && pnode->data != child) {
+-    pnext = &pnode->next;
+-    pnode = pnode->next;
+-  }
+-
+-  DEBUGASSERT(pnode);
+-  if(pnode) {
+-    *pnext = pnode->next;
+-    free(pnode);
+-  }
+-
+-  child->set.priority.parent = 0;
+-  child->set.priority.exclusive = FALSE;
+-}
+-
+-CURLcode Curl_data_priority_add_child(struct Curl_easy *parent,
+-                                      struct Curl_easy *child,
+-                                      bool exclusive)
+-{
+-  if(child->set.priority.parent) {
+-    priority_remove_child(child->set.priority.parent, child);
+-  }
+-
+-  if(parent) {
+-    struct Curl_data_prio_node **tail;
+-    struct Curl_data_prio_node *pnode;
+-
+-    pnode = calloc(1, sizeof(*pnode));
+-    if(!pnode)
+-      return CURLE_OUT_OF_MEMORY;
+-    pnode->data = child;
+-
+-    if(parent->set.priority.children && exclusive) {
+-      /* exclusive: move all existing children underneath the new child */
+-      struct Curl_data_prio_node *node = parent->set.priority.children;
+-      while(node) {
+-        node->data->set.priority.parent = child;
+-        node = node->next;
+-      }
+-
+-      tail = &child->set.priority.children;
+-      while(*tail)
+-        tail = &(*tail)->next;
+-
+-      DEBUGASSERT(!*tail);
+-      *tail = parent->set.priority.children;
+-      parent->set.priority.children = 0;
+-    }
+-
+-    tail = &parent->set.priority.children;
+-    while(*tail) {
+-      (*tail)->data->set.priority.exclusive = FALSE;
+-      tail = &(*tail)->next;
+-    }
+-
+-    DEBUGASSERT(!*tail);
+-    *tail = pnode;
+-  }
+-
+-  child->set.priority.parent = parent;
+-  child->set.priority.exclusive = exclusive;
+-  return CURLE_OK;
+-}
+-
+-#endif /* USE_NGHTTP2 */
+-
+-#ifdef USE_NGHTTP2
+-static void data_priority_cleanup(struct Curl_easy *data)
+-{
+-  while(data->set.priority.children) {
+-    struct Curl_easy *tmp = data->set.priority.children->data;
+-    priority_remove_child(data, tmp);
+-    if(data->set.priority.parent)
+-      Curl_data_priority_add_child(data->set.priority.parent, tmp, FALSE);
+-  }
+-
+-  if(data->set.priority.parent)
+-    priority_remove_child(data->set.priority.parent, data);
+-}
+-#endif
+ 
+ void Curl_data_priority_clear_state(struct Curl_easy *data)
+ {
+   memset(&data->state.priority, 0, sizeof(data->state.priority));
+diff --git a/lib/urldata.h b/lib/urldata.h
+index 9d4c33a..f12958d 100644
+--- a/lib/urldata.h
++++ b/lib/urldata.h
+@@ -1145,15 +1145,7 @@ struct Curl_data_prio_node {
+  * TODO: we need to adapt it to the new priority scheme as defined in RFC 9218
+  */
+ struct Curl_data_priority {
+-#ifdef USE_NGHTTP2
+-  /* tree like dependencies only implemented in nghttp2 */
+-  struct Curl_easy *parent;
+-  struct Curl_data_prio_node *children;
+-#endif
+   int weight;
+-#ifdef USE_NGHTTP2
+-  BIT(exclusive);
+-#endif
+ };
+ 
+ /* Timers */
+-- 
+2.45.4
+