From f5c88c8960365d656099b231df1c493636244150 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Tue, 25 Aug 2026 21:25:56 +0000 Subject: [PATCH 1/2] Patch mysql for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379 --- SPECS/mysql/CVE-2026-63379.patch | 103 ++++++++++ SPECS/mysql/CVE-2026-63381.patch | 40 ++++ SPECS/mysql/CVE-2026-63382.patch | 310 +++++++++++++++++++++++++++++++ SPECS/mysql/CVE-2026-63383.patch | 42 +++++ SPECS/mysql/CVE-2026-63384.patch | 54 ++++++ SPECS/mysql/CVE-2026-63385.patch | 46 +++++ SPECS/mysql/CVE-2026-63387.patch | 43 +++++ SPECS/mysql/CVE-2026-63388.patch | 138 ++++++++++++++ SPECS/mysql/mysql.spec | 13 +- 9 files changed, 788 insertions(+), 1 deletion(-) create mode 100644 SPECS/mysql/CVE-2026-63379.patch create mode 100644 SPECS/mysql/CVE-2026-63381.patch create mode 100644 SPECS/mysql/CVE-2026-63382.patch create mode 100644 SPECS/mysql/CVE-2026-63383.patch create mode 100644 SPECS/mysql/CVE-2026-63384.patch create mode 100644 SPECS/mysql/CVE-2026-63385.patch create mode 100644 SPECS/mysql/CVE-2026-63387.patch create mode 100644 SPECS/mysql/CVE-2026-63388.patch diff --git a/SPECS/mysql/CVE-2026-63379.patch b/SPECS/mysql/CVE-2026-63379.patch new file mode 100644 index 00000000000..ce2973af95f --- /dev/null +++ b/SPECS/mysql/CVE-2026-63379.patch @@ -0,0 +1,103 @@ +From 4f35b1316325bdfb44b49e2e06349ba50931c056 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 11:04:48 -0400 +Subject: [PATCH] http: Discard trailers. + +Previously, we would insert any trailers directly into the header +list. But this was incorrect, since trailers are not supposed to be +treated as normal headers. This behavior could lead to conflicting +interpretation between HTTP servers and proxies, and enable +different kinds of attacks. + +Fixes GHSA-2gmv-p5m7-98p6. + +Reported by @sebastianosrt. + +Tracking: X13. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636.patch +--- + extra/libevent/libevent-2.1.11-stable/http.c | 26 ++++++++++++++++---- + 1 file changed, 21 insertions(+), 5 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 765f501..4cd168b 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -182,6 +182,10 @@ static evutil_socket_t bind_socket_ai(struct evutil_addrinfo *, int reuse); + static evutil_socket_t bind_socket(const char *, ev_uint16_t, int reuse); + static void name_from_addr(struct sockaddr *, ev_socklen_t, char **, char **); + static struct evhttp_uri *evhttp_uri_parse_authority(char *source_uri); ++static enum message_read_status evhttp_parse_headers_impl_( ++ struct evhttp_request *req, ++ struct evbuffer *buffer, ++ struct evkeyvalq *headers); + static int evhttp_associate_new_request_with_connection( + struct evhttp_connection *evcon); + static void evhttp_connection_start_detectclose( +@@ -989,8 +993,10 @@ static void + evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) + { + struct evbuffer *buf = bufferevent_get_input(evcon->bufev); ++ struct evkeyvalq tmp_headers; ++ TAILQ_INIT(&tmp_headers); + +- switch (evhttp_parse_headers_(req, buf)) { ++ switch (evhttp_parse_headers_impl_(req, buf, &tmp_headers)) { + case DATA_CORRUPTED: + case DATA_TOO_LONG: + evhttp_connection_fail_(evcon, EVREQ_HTTP_DATA_TOO_LONG); +@@ -1004,6 +1010,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) + default: + break; + } ++ ++ evhttp_clear_headers(&tmp_headers); + } + + static void +@@ -2108,14 +2116,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) + return (0); + } + +-enum message_read_status +-evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) ++/* As `evhttp_parse_headers_`, but put any headers we find into `headers`. */ ++static enum message_read_status ++evhttp_parse_headers_impl_( ++ struct evhttp_request *req, ++ struct evbuffer *buffer, ++ struct evkeyvalq *headers) + { + enum message_read_status errcode = DATA_CORRUPTED; + char *line; + enum message_read_status status = MORE_DATA_EXPECTED; + +- struct evkeyvalq* headers = req->input_headers; + size_t len; + while ((line = evbuffer_readln(buffer, &len, EVBUFFER_EOL_CRLF)) + != NULL) { +@@ -2171,7 +2182,6 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) + return (errcode); + } + +- + /* Return true if 'ch' is a single linear WS character (per the HTTP spec). + * We reject CR and LF elsewhere. */ + #define IS_LWS(ch) \ +@@ -2292,6 +2302,12 @@ evhttp_validate_len_and_encoding_(struct evhttp_request *req) + } + + ++enum message_read_status ++evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) ++{ ++ return evhttp_parse_headers_impl_(req, buffer, req->input_headers); ++} ++ + static int + evhttp_get_body_length(struct evhttp_request *req) + { +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63381.patch b/SPECS/mysql/CVE-2026-63381.patch new file mode 100644 index 00000000000..9d9f7f0ca2c --- /dev/null +++ b/SPECS/mysql/CVE-2026-63381.patch @@ -0,0 +1,40 @@ +From 460c0b9d53f46fa865e45f809c6548b209844751 Mon Sep 17 00:00:00 2001 +From: Alexis +Date: Tue, 9 Jun 2026 15:09:05 +0200 +Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference. + +If `evbuffer_add_buffer_reference` was called to add a reference to +an empty buffer, the resulting code would produce dangling pointers +that could later lead to a use-after-free. + +Fixes GHSA-c2pj-cg4r-88c8. + +Tracking: X8. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c.patch +--- + extra/libevent/libevent-2.1.11-stable/buffer.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/buffer.c b/extra/libevent/libevent-2.1.11-stable/buffer.c +index a51b6c5..b878ef6 100644 +--- a/extra/libevent/libevent-2.1.11-stable/buffer.c ++++ b/extra/libevent/libevent-2.1.11-stable/buffer.c +@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf) + + if (out_total_len == 0) { + /* There might be an empty chain at the start of outbuf; free +- * it. */ ++ * it. Reset the chain pointers afterwards so the subsequent ++ * APPEND_CHAIN_MULTICAST does not dereference the freed chain ++ * through outbuf->first / last_with_datap. */ + evbuffer_free_all_chains(outbuf->first); ++ outbuf->first = NULL; ++ outbuf->last = NULL; ++ outbuf->last_with_datap = &outbuf->first; + } + APPEND_CHAIN_MULTICAST(outbuf, inbuf); + +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63382.patch b/SPECS/mysql/CVE-2026-63382.patch new file mode 100644 index 00000000000..89f3f613338 --- /dev/null +++ b/SPECS/mysql/CVE-2026-63382.patch @@ -0,0 +1,310 @@ +From 594db0189f3c92ae98bc5db87b65041fc23c80b2 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 08:32:25 -0400 +Subject: [PATCH 1/2] http: Treat CRLF strictly in HTTP chunks. + +According to RFC 9112, we can't treat LF alone as a terminator in +the chunked encoding. + +Reported by @xclow3n + +Part of GHSA-q39v-w2g7-gr8j + +Tracking: X11 +--- + extra/libevent/libevent-2.1.11-stable/http.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 4ea6c25..9175bea 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -916,7 +916,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) + if (req->ntoread < 0) { + /* Read chunk size */ + ev_int64_t ntoread; +- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); ++ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); + char *endp; + int error; + if (p == NULL) +-- +2.45.4 + + +From 239dd551cb9f3af4d1e510e66595983fd7462bee Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 10:37:46 -0400 +Subject: [PATCH 2/2] http: Tighten acceptable headers to prevent request + smuggling. + +Previously, we accepted a wider variety of combinations of +Content-Length and Transfer-Encoding, and we didn't parse +Transfer-Encoding according to the full rules of the relevant RFC. +This made evhttp interpret these headers in a +non-standards-compliant way that had the potential to differ from +a more compliant proxy or HTTP server. Thus, when used _as_ an +HTTP proxy, evhttp had the potential to enable http smuggling +attacks. + +Fixes GHSA-q39v-w2g7-gr8j. + +Originally reported by @xclow3n; and then by @kodareef5, +@nstaller0490, @AsafMeizneer, and @yaotushaozhu (in that order). + +(Note that this fix assumes that we have _also_ disabled support for +CR and LF in header lines.) + +Tracking: X12. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch +--- + .../libevent-2.1.11-stable/http-internal.h | 14 ++ + extra/libevent/libevent-2.1.11-stable/http.c | 164 +++++++++++++++++- + 2 files changed, 172 insertions(+), 6 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http-internal.h b/extra/libevent/libevent-2.1.11-stable/http-internal.h +index feaf436..4d52504 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http-internal.h ++++ b/extra/libevent/libevent-2.1.11-stable/http-internal.h +@@ -185,6 +185,20 @@ EVENT2_EXPORT_SYMBOL + void evhttp_connection_fail_(struct evhttp_connection *, + enum evhttp_request_error error); + ++enum evhttp_transfer_encoding_header_status { ++ /* This Transfer-Encoding line was invalid. ++ * (We consider all "chunked" encodings invalid except those at the end ++ * of the sequence.) */ ++ TE_INVALID, ++ /* This Transfer-Encoding line ended with the "chunked" encoding. */ ++ TE_ENDS_IN_CHUNKED, ++ /* This Transfer-Encoding line was valid and did not contain "chunked" */ ++ TE_NO_CHUNKED, ++}; ++int evhttp_str_is_chunked_(const char *value, const char *eos); ++enum evhttp_transfer_encoding_header_status ++evhttp_check_transfer_encoding_(const char *value); ++ + enum message_read_status; + + EVENT2_EXPORT_SYMBOL +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 9175bea..765f501 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -123,7 +123,6 @@ + #ifndef NI_NUMERICSERV + #define NI_NUMERICSERV 2 + #endif +- + static int + fake_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, + size_t hostlen, char *serv, size_t servlen, int flags) +@@ -163,6 +162,8 @@ fake_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, + + #endif + ++static int evhttp_validate_len_and_encoding_(struct evhttp_request *req); ++ + #define REQ_VERSION_BEFORE(req, major_v, minor_v) \ + ((req)->major < (major_v) || \ + ((req)->major == (major_v) && (req)->minor < (minor_v))) +@@ -1899,6 +1900,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) + return (NULL); + } + ++/* Like evhttp_find_header, but set *duplicate to 1 if the header appears ++ * more than once, and to 0 otherwise. ++ */ ++static const char * ++evhttp_find_unique_header(const struct evkeyvalq *headers, const char *key, ++ int *duplicate) ++{ ++ const char *result = NULL; ++ struct evkeyval *header; ++ ++ *duplicate = 0; ++ ++ TAILQ_FOREACH(header, headers, next) { ++ if (evutil_ascii_strcasecmp(header->key, key) == 0) { ++ if (result == NULL) { ++ result = header->value; ++ } else { ++ *duplicate = 1; ++ break; ++ } ++ } ++ } ++ ++ return (result); ++} ++ + void + evhttp_clear_headers(struct evkeyvalq *headers) + { +@@ -2144,6 +2171,127 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) + return (errcode); + } + ++ ++/* Return true if 'ch' is a single linear WS character (per the HTTP spec). ++ * We reject CR and LF elsewhere. */ ++#define IS_LWS(ch) \ ++ (((ch) == ' ' ) || ((ch) == '\t')) ++ ++/* Returns true when the string beginning at `value` and ending at `eos` ++ * (non-inclusive) is a `transfer-coding` "chunked". Case insensitive. ++ */ ++int ++evhttp_str_is_chunked_(const char *value, const char *eos) ++{ ++ /* the end of the encoding. */ ++ const char *end; ++ ++ if (eos == NULL) { ++ eos = value + strlen(value); ++ } ++ ++ while (value < eos && IS_LWS(*value)) { ++ ++value; ++ } ++ end = value; ++ /* A transfer-coding can end with OWS ; OWS to indicate a ++ * transfer-parameter. (See RFC 9110) ++ */ ++ while (end < eos && !IS_LWS(*end) && *end != ';') { ++ ++end; ++ } ++ ++ return (end - value) == strlen("chunked") ++ && evutil_ascii_strncasecmp(value, "chunked", strlen("chunked")) == 0; ++} ++ ++/* Check a single Transfer-Encoding header value. ++ * ++ * Returns an evhttp_transfer_encoding_header_status value depending ++ * on its contents. ++ */ ++enum evhttp_transfer_encoding_header_status ++evhttp_check_transfer_encoding_(const char *value) ++{ ++ const char *comma; ++ ++ while ((comma = strchr(value, ',')) != NULL) { ++ if (evhttp_str_is_chunked_(value, comma)) { ++ /* If we find that an encoding is chunked ++ * and it is followed by a comma, it is not the final ++ * encoding ++ */ ++ return TE_INVALID; ++ } ++ value = comma + 1; ++ } ++ ++ if (evhttp_str_is_chunked_(value, NULL)) { ++ return TE_ENDS_IN_CHUNKED; ++ } else { ++ return TE_NO_CHUNKED; ++ } ++} ++ ++ ++/* Return 0 if the Transfer-Encoding and Content-Length heeaders appear to be consistent, ++ * and -1 otherwise. ++ * ++ * Sets "req->chunked" if appropriate. ++ * ++ * Used to prevent request smuggling. ++ */ ++static int ++evhttp_validate_len_and_encoding_(struct evhttp_request *req) ++{ ++ struct evkeyvalq *headers = req->input_headers; ++ struct evkeyval *h = NULL; ++ int is_chunked = 0; ++ int dup_cl = 0; ++ ++ if (evhttp_find_header(headers, "Transfer-Encoding") != NULL && ++ evhttp_find_unique_header(headers, "Content-Length", &dup_cl) != NULL) { ++ /* Both TE and CL were present: Not allowed. */ ++ return -1; ++ } ++ if (dup_cl) { ++ /* CL was present twice: Not allowed. ++ * (Technically we can permit this if the values are the same, ++ * but we don't.) */ ++ return -1; ++ } ++ ++ /* Now walk through the Transfer-Encoding headers. */ ++ TAILQ_FOREACH(h, headers, next) { ++ if (evutil_ascii_strcasecmp(h->key, "Transfer-Encoding") == 0) { ++ if (is_chunked) { ++ /* We already encountered a chunked ++ encoding; no further encodings are allowed */ ++ return -1; ++ } ++ ++ switch (evhttp_check_transfer_encoding_(h->value)) ++ { ++ case TE_INVALID: ++ /* We found "chunked" somewhere not at the end. */ ++ return -1; ++ case TE_ENDS_IN_CHUNKED: ++ /* We found chunked at the end. */ ++ is_chunked = 1; ++ break; ++ case TE_NO_CHUNKED: ++ /* "chunked" didn't appear; this is fine. */ ++ break; ++ } ++ } ++ } ++ ++ req->chunked = is_chunked; ++ ++ return 0; ++} ++ ++ + static int + evhttp_get_body_length(struct evhttp_request *req) + { +@@ -2203,8 +2351,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) + static void + evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) + { +- const char *xfer_enc; +- + /* If this is a request without a body, then we are done */ + if (req->kind == EVHTTP_REQUEST && + !evhttp_method_may_have_body(req->type)) { +@@ -2212,9 +2358,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) + return; + } + evcon->state = EVCON_READING_BODY; +- xfer_enc = evhttp_find_header(req->input_headers, "Transfer-Encoding"); +- if (xfer_enc != NULL && evutil_ascii_strcasecmp(xfer_enc, "chunked") == 0) { +- req->chunked = 1; ++ ++ if (req->chunked) { + req->ntoread = -1; + } else { + if (evhttp_get_body_length(req) == -1) { +@@ -2300,6 +2445,13 @@ evhttp_read_header(struct evhttp_connection *evcon, + return; + } + ++ if (evhttp_validate_len_and_encoding_(req) < 0) { ++ event_debug(("%s: bad combination of headers on "EV_SOCK_FMT"\n", ++ __func__, EV_SOCK_ARG(fd))); ++ evhttp_connection_fail_(evcon, EVREQ_HTTP_INVALID_HEADER); ++ return; ++ } ++ + /* Callback can shut down connection with negative return value */ + if (req->header_cb != NULL) { + if ((*req->header_cb)(req, req->cb_arg) < 0) { +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63383.patch b/SPECS/mysql/CVE-2026-63383.patch new file mode 100644 index 00000000000..d83e421c82f --- /dev/null +++ b/SPECS/mysql/CVE-2026-63383.patch @@ -0,0 +1,42 @@ +From 5cb9eb4c9abe9717401631991318afae133528d8 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:53:23 -0400 +Subject: [PATCH] evrpc: Fix out-of-bounds read in decode_tag_internal + +This bug could allow an attacker to cause an evrpc client or server +to read out of bounds when decoding a tag. + +Fixes GHSA-fj29-64w6-73h6. + +Reported by @Brubbish. + +Tracking: X5. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb.patch +--- + extra/libevent/libevent-2.1.11-stable/event_tagging.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/event_tagging.c b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +index 790dff3..9ee642b 100644 +--- a/extra/libevent/libevent-2.1.11-stable/event_tagging.c ++++ b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +@@ -210,12 +210,13 @@ decode_tag_internal(ev_uint32_t *ptag, struct evbuffer *evbuf, int dodrain) + * the encoding of a number is at most one byte more than its + * storage size. however, it may also be much smaller. + */ ++ size_t pullup_len = len < sizeof(number) + 1 ? len : sizeof(number) + 1; + data = evbuffer_pullup( +- evbuf, len < sizeof(number) + 1 ? len : sizeof(number) + 1); ++ evbuf, pullup_len); + if (!data) + return (-1); + +- while (count++ < len) { ++ while (count++ < pullup_len) { + ev_uint8_t lower = *data++; + if (shift >= 28) { + /* Make sure it fits into 32 bits */ +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63384.patch b/SPECS/mysql/CVE-2026-63384.patch new file mode 100644 index 00000000000..03777ae1b4b --- /dev/null +++ b/SPECS/mysql/CVE-2026-63384.patch @@ -0,0 +1,54 @@ +From 506a9e9af64067dd83fa329435cff75ed957e6eb Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 10:08:22 -0400 +Subject: [PATCH] evrpc: Fix integer overflow in evtag_unmarshal_header. + +On platforms where int is 32 bits, if this function tried to decode +a header declaring a payload longer than INT_MAX bytes long, this +function would return a negative value, which could cause incorrect +behaviors, incorrect allocations, or denial-of-service. + +We solve this (for now) by rejecting any payload length larger +than INT_MAX. + +Fixes GHSA-45c6-qx49-89m8 + +Reported by @Brubbish + +Tracking: X5 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416.patch +--- + extra/libevent/libevent-2.1.11-stable/event_tagging.c | 2 +- + extra/libevent/libevent-2.1.11-stable/include/event2/tag.h | 2 ++ + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/event_tagging.c b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +index b021e8c..790dff3 100644 +--- a/extra/libevent/libevent-2.1.11-stable/event_tagging.c ++++ b/extra/libevent/libevent-2.1.11-stable/event_tagging.c +@@ -445,7 +445,7 @@ evtag_unmarshal_header(struct evbuffer *evbuf, ev_uint32_t *ptag) + + if (decode_tag_internal(ptag, evbuf, 1 /* dodrain */) == -1) + return (-1); +- if (evtag_decode_int(&len, evbuf) == -1) ++ if (evtag_decode_int(&len, evbuf) == -1 || len > INT_MAX) + return (-1); + + if (evbuffer_get_length(evbuf) < len) +diff --git a/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h b/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h +index 2f73bfc..ac13049 100644 +--- a/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h ++++ b/extra/libevent/libevent-2.1.11-stable/include/event2/tag.h +@@ -64,6 +64,8 @@ void evtag_init(void); + /** + Unmarshals the header and returns the length of the payload + ++ Returns an error if the payload length is above INT_MAX. ++ + @param evbuf the buffer from which to unmarshal data + @param ptag a pointer in which the tag id is being stored + @returns -1 on failure or the number of bytes in the remaining payload. +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63385.patch b/SPECS/mysql/CVE-2026-63385.patch new file mode 100644 index 00000000000..399da1139ef --- /dev/null +++ b/SPECS/mysql/CVE-2026-63385.patch @@ -0,0 +1,46 @@ +From cf97e6ba789c9caf743db3575995bfcc037a9c63 Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Fri, 26 Jun 2026 09:08:47 -0400 +Subject: [PATCH] http: Reject headers containing CRLF. + +This causes us to reject obfs-fold, which is deprecated in RFC 9112. + +Otherwise, we would have a header injection opportunity for +certain proxy chains. + +Reported by @AsafMeizner + +Part of GHSA-jcwh-pvf2-73p2 + +Tracking: X10. +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2.patch +--- + extra/libevent/libevent-2.1.11-stable/http.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 073c8c1..4ea6c25 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -1946,13 +1946,11 @@ evhttp_header_is_valid_value(const char *value) + { + const char *p = value; + +- while ((p = strpbrk(p, "\r\n")) != NULL) { +- /* we really expect only one new line */ +- p += strspn(p, "\r\n"); +- /* we expect a space or tab for continuation */ +- if (*p != ' ' && *p != '\t') +- return (0); ++ if (strpbrk(p, "\r\n") != NULL) { ++ /* Reject any header containing CR or LF. */ ++ return (0); + } ++ + return (1); + } + +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63387.patch b/SPECS/mysql/CVE-2026-63387.patch new file mode 100644 index 00000000000..3280374f89f --- /dev/null +++ b/SPECS/mysql/CVE-2026-63387.patch @@ -0,0 +1,43 @@ +From 91374085713ebfa1d1e5093f45bcfe5689f1eecb Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:08:43 -0400 +Subject: [PATCH] evdns: Fix out-of-bounds write in dnsname_to_labels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +This bug would cause the program to write a single 0 byte off the +end of a stack buffer, if the code ever tried to make a DNS response +exactly 2^16 + 1 bytes long, ending with a DNS name. + +Resolves issue GHSA-58rx-7448-jw47. + +This issue was identified by Michał Majchrowicz and +Marcin Wyczechowski, members of the AFINE Team. + +Tracking: X1 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/377b9022c3ac61aa4540b5dc4b70c60bf74c663d.patch +--- + extra/libevent/libevent-2.1.11-stable/evdns.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/evdns.c b/extra/libevent/libevent-2.1.11-stable/evdns.c +index de3848a..b03bea6 100644 +--- a/extra/libevent/libevent-2.1.11-stable/evdns.c ++++ b/extra/libevent/libevent-2.1.11-stable/evdns.c +@@ -1671,7 +1671,10 @@ dnsname_to_labels(u8 *const buf, size_t buf_len, off_t j, + /* the labels must be terminated by a 0. */ + /* It's possible that the name ended in a . */ + /* in which case the zero is already there */ +- if (!j || buf[j-1]) buf[j++] = 0; ++ if ((size_t)j >= buf_len) ++ return -2; ++ if (!j || buf[j-1]) ++ buf[j++] = 0; + return j; + overflow: + return (-2); +-- +2.45.4 + diff --git a/SPECS/mysql/CVE-2026-63388.patch b/SPECS/mysql/CVE-2026-63388.patch new file mode 100644 index 00000000000..a6b81610702 --- /dev/null +++ b/SPECS/mysql/CVE-2026-63388.patch @@ -0,0 +1,138 @@ +From 2e497e917a8a0260b59954ae169cad2c942187de Mon Sep 17 00:00:00 2001 +From: Nick Mathewson +Date: Wed, 24 Jun 2026 09:33:02 -0400 +Subject: [PATCH] bufferevent: Fix heap out-of-bounds write via + AF_UNIX+http+NDEBUG + +When running an evhttp server over an AF_UNIX socket, +on a copy of libevent compiled with NDEBUG, +it was possible for an attacker to use a crafted AF_UNIX address to +cause a heap overflow when recording the address. + +This issue could also be triggered by direct calls +to the internal function bufferevent_socket_set_conn_address_ +on a copy of libevent compiled with NDEBUG. + +This bug still affected copies of libevent compiled without NDEBUG: +except that under those conditions, it would cause an assertion +failure with an abort() rather than a heap overflow. + +As a fix: + - We check the length of the provided address unconditionally + (regardless of NDEBUG) + - We handle failures caused by the provided address being too long. + - We allocate enough room to store an AF_UNIX address. + +Resolves GHSA-cvq5-vrvr-j338. + +Reported by @mat-mo. + +Tracking: X3 +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: https://github.com/libevent/libevent/commit/ef38f926e9cd1f082416c6fff13587bc1f431d72.patch +--- + .../bufferevent-internal.h | 11 ++++++----- + .../libevent-2.1.11-stable/bufferevent_sock.c | 17 ++++++++++++----- + extra/libevent/libevent-2.1.11-stable/http.c | 4 +++- + 3 files changed, 21 insertions(+), 11 deletions(-) + +diff --git a/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h b/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h +index 87ab9ad..3802b59 100644 +--- a/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h ++++ b/extra/libevent/libevent-2.1.11-stable/bufferevent-internal.h +@@ -34,6 +34,7 @@ extern "C" { + #include "event2/event_struct.h" + #include "evconfig-private.h" + #include "event2/util.h" ++#include "util-internal.h" + #include "defer-internal.h" + #include "evthread-internal.h" + #include "event2/thread.h" +@@ -224,10 +225,10 @@ struct bufferevent_private { + * So we need to save it, just after we connected to remote server, or + * after resolving (to avoid extra dns requests during retrying, since UDP + * is slow) */ +- union { +- struct sockaddr_in6 in6; +- struct sockaddr_in in; +- } conn_address; ++ /* NOTE: it might be nice to use fewer bytes here, but we need to store ++ * sockaddr_un sometimes in order to make AF_UNIX sockets work as expected ++ * with extra/libevent/libevent-2.1.11-stable/http.c. */ ++ struct sockaddr_storage conn_address; + + struct evdns_getaddrinfo_request *dns_request; + }; +@@ -449,7 +450,7 @@ void + bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, evutil_socket_t fd); + + EVENT2_EXPORT_SYMBOL +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, struct sockaddr *addr, size_t addrlen); + + +diff --git a/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c b/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c +index f275b02..d244617 100644 +--- a/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c ++++ b/extra/libevent/libevent-2.1.11-stable/bufferevent_sock.c +@@ -116,13 +116,17 @@ bufferevent_socket_set_conn_address_fd_(struct bufferevent *bev, + getpeername(fd, addr, &len); + } + +-void ++int + bufferevent_socket_set_conn_address_(struct bufferevent *bev, + struct sockaddr *addr, size_t addrlen) + { + struct bufferevent_private *bev_p = BEV_UPCAST(bev); +- EVUTIL_ASSERT(addrlen <= sizeof(bev_p->conn_address)); +- memcpy(&bev_p->conn_address, addr, addrlen); ++ if (addrlen <= sizeof(bev_p->conn_address)) { ++ memcpy(&bev_p->conn_address, addr, addrlen); ++ return 0; ++ } else { ++ return EVUTIL_EAI_FAIL; ++ } + } + + static void +@@ -472,6 +476,11 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + bufferevent_decref_and_unlock_(bev); + return; + } ++ if (result == 0) { ++ /* XXX use the other addrinfos? */ ++ result = bufferevent_socket_set_conn_address_( ++ bev, ai->ai_addr, (int)ai->ai_addrlen); ++ } + if (result != 0) { + bev_p->dns_error = result; + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +@@ -481,8 +490,6 @@ bufferevent_connect_getaddrinfo_cb(int result, struct evutil_addrinfo *ai, + return; + } + +- /* XXX use the other addrinfos? */ +- bufferevent_socket_set_conn_address_(bev, ai->ai_addr, (int)ai->ai_addrlen); + r = bufferevent_socket_connect(bev, ai->ai_addr, (int)ai->ai_addrlen); + if (r < 0) + bufferevent_run_eventcb_(bev, BEV_EVENT_ERROR, 0); +diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c +index 5331602..073c8c1 100644 +--- a/extra/libevent/libevent-2.1.11-stable/http.c ++++ b/extra/libevent/libevent-2.1.11-stable/http.c +@@ -4261,7 +4261,9 @@ evhttp_get_request_connection( + goto err; + if (bufferevent_disable(evcon->bufev, EV_WRITE)) + goto err; +- bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen); ++ if (bufferevent_socket_set_conn_address_(evcon->bufev, sa, salen)) { ++ goto err; ++ } + + return (evcon); + +-- +2.45.4 + diff --git a/SPECS/mysql/mysql.spec b/SPECS/mysql/mysql.spec index f4e745be819..1945d67245c 100644 --- a/SPECS/mysql/mysql.spec +++ b/SPECS/mysql/mysql.spec @@ -3,7 +3,7 @@ Summary: MySQL. Name: mysql Version: 8.0.46 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2 with exceptions AND LGPLv2 AND BSD Vendor: Microsoft Corporation Distribution: Azure Linux @@ -19,6 +19,14 @@ Patch4: CVE-2025-0838.patch # Patch to skip failing ptests on x86 architecture %ifarch x86_64 Patch5: skip-failing-ptests.patch +Patch6: CVE-2026-63379.patch +Patch7: CVE-2026-63381.patch +Patch8: CVE-2026-63382.patch +Patch9: CVE-2026-63383.patch +Patch10: CVE-2026-63384.patch +Patch11: CVE-2026-63385.patch +Patch12: CVE-2026-63387.patch +Patch13: CVE-2026-63388.patch %endif BuildRequires: cmake @@ -115,6 +123,9 @@ sudo -u test ctest --exclude-regex merge_large_tests || { cat Testing/Temporary/ %{_libdir}/pkgconfig/mysqlclient.pc %changelog +* Tue Aug 25 2026 Azure Linux Security Servicing Account - 8.0.46-2 +- Patch for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379 + * Wed Apr 22 2026 Kanishk Bansal - 8.0.46-1 - Upgrade to fix CVE-2026-6409, CVE-2026-34278, CVE-2026-35239, CVE-2026-21998, CVE-2026-35237, CVE-2026-22009, CVE-2026-34270, CVE-2026-34293, CVE-2026-34271, CVE-2026-22002, CVE-2026-22017, From 6bfa66f39e7765fb422d08b228292fc4b4bc7def Mon Sep 17 00:00:00 2001 From: akhila-guruju Date: Wed, 26 Aug 2026 18:57:22 +0530 Subject: [PATCH 2/2] modify AI patches to fix build --- SPECS/mysql/CVE-2026-63379.patch | 32 +++++--------- SPECS/mysql/CVE-2026-63382.patch | 76 +++++++++++--------------------- SPECS/mysql/mysql.spec | 4 +- 3 files changed, 40 insertions(+), 72 deletions(-) diff --git a/SPECS/mysql/CVE-2026-63379.patch b/SPECS/mysql/CVE-2026-63379.patch index ce2973af95f..52ae72916d9 100644 --- a/SPECS/mysql/CVE-2026-63379.patch +++ b/SPECS/mysql/CVE-2026-63379.patch @@ -1,4 +1,4 @@ -From 4f35b1316325bdfb44b49e2e06349ba50931c056 Mon Sep 17 00:00:00 2001 +From b847071141b3827900d536594ec9045eb0a4c485 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 26 Jun 2026 11:04:48 -0400 Subject: [PATCH] http: Discard trailers. @@ -14,17 +14,17 @@ Fixes GHSA-2gmv-p5m7-98p6. Reported by @sebastianosrt. Tracking: X13. -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636.patch + +Upstream Patch reference: https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485.patch --- - extra/libevent/libevent-2.1.11-stable/http.c | 26 ++++++++++++++++---- - 1 file changed, 21 insertions(+), 5 deletions(-) + extra/libevent/libevent-2.1.11-stable/http.c | 25 ++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c -index 765f501..4cd168b 100644 +index 5331602a..409b02e0 100644 --- a/extra/libevent/libevent-2.1.11-stable/http.c +++ b/extra/libevent/libevent-2.1.11-stable/http.c -@@ -182,6 +182,10 @@ static evutil_socket_t bind_socket_ai(struct evutil_addrinfo *, int reuse); +@@ -181,6 +181,10 @@ static evutil_socket_t bind_socket_ai(struct evutil_addrinfo *, int reuse); static evutil_socket_t bind_socket(const char *, ev_uint16_t, int reuse); static void name_from_addr(struct sockaddr *, ev_socklen_t, char **, char **); static struct evhttp_uri *evhttp_uri_parse_authority(char *source_uri); @@ -35,7 +35,7 @@ index 765f501..4cd168b 100644 static int evhttp_associate_new_request_with_connection( struct evhttp_connection *evcon); static void evhttp_connection_start_detectclose( -@@ -989,8 +993,10 @@ static void +@@ -988,8 +992,10 @@ static void evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) { struct evbuffer *buf = bufferevent_get_input(evcon->bufev); @@ -47,7 +47,7 @@ index 765f501..4cd168b 100644 case DATA_CORRUPTED: case DATA_TOO_LONG: evhttp_connection_fail_(evcon, EVREQ_HTTP_DATA_TOO_LONG); -@@ -1004,6 +1010,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) +@@ -1003,6 +1009,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req) default: break; } @@ -56,7 +56,7 @@ index 765f501..4cd168b 100644 } static void -@@ -2108,14 +2116,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) +@@ -2083,14 +2091,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line) return (0); } @@ -77,18 +77,10 @@ index 765f501..4cd168b 100644 size_t len; while ((line = evbuffer_readln(buffer, &len, EVBUFFER_EOL_CRLF)) != NULL) { -@@ -2171,7 +2182,6 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) +@@ -2146,6 +2157,12 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) return (errcode); } -- - /* Return true if 'ch' is a single linear WS character (per the HTTP spec). - * We reject CR and LF elsewhere. */ - #define IS_LWS(ch) \ -@@ -2292,6 +2302,12 @@ evhttp_validate_len_and_encoding_(struct evhttp_request *req) - } - - +enum message_read_status +evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) +{ @@ -99,5 +91,5 @@ index 765f501..4cd168b 100644 evhttp_get_body_length(struct evhttp_request *req) { -- -2.45.4 +2.34.1 diff --git a/SPECS/mysql/CVE-2026-63382.patch b/SPECS/mysql/CVE-2026-63382.patch index 89f3f613338..11ce3e1451c 100644 --- a/SPECS/mysql/CVE-2026-63382.patch +++ b/SPECS/mysql/CVE-2026-63382.patch @@ -1,41 +1,7 @@ -From 594db0189f3c92ae98bc5db87b65041fc23c80b2 Mon Sep 17 00:00:00 2001 -From: Nick Mathewson -Date: Fri, 26 Jun 2026 08:32:25 -0400 -Subject: [PATCH 1/2] http: Treat CRLF strictly in HTTP chunks. - -According to RFC 9112, we can't treat LF alone as a terminator in -the chunked encoding. - -Reported by @xclow3n - -Part of GHSA-q39v-w2g7-gr8j - -Tracking: X11 ---- - extra/libevent/libevent-2.1.11-stable/http.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c -index 4ea6c25..9175bea 100644 ---- a/extra/libevent/libevent-2.1.11-stable/http.c -+++ b/extra/libevent/libevent-2.1.11-stable/http.c -@@ -916,7 +916,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) - if (req->ntoread < 0) { - /* Read chunk size */ - ev_int64_t ntoread; -- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); -+ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); - char *endp; - int error; - if (p == NULL) --- -2.45.4 - - -From 239dd551cb9f3af4d1e510e66595983fd7462bee Mon Sep 17 00:00:00 2001 +From ac38703b2d312200c4f967f02936af0118d384a0 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 26 Jun 2026 10:37:46 -0400 -Subject: [PATCH 2/2] http: Tighten acceptable headers to prevent request +Subject: [PATCH] http: Tighten acceptable headers to prevent request smuggling. Previously, we accepted a wider variety of combinations of @@ -56,15 +22,18 @@ Originally reported by @xclow3n; and then by @kodareef5, CR and LF in header lines.) Tracking: X12. -Signed-off-by: Azure Linux Security Servicing Account -Upstream-reference: https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch + +Upstream Patch reference: +1. https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0.patch +2. https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6.patch + --- .../libevent-2.1.11-stable/http-internal.h | 14 ++ extra/libevent/libevent-2.1.11-stable/http.c | 164 +++++++++++++++++- - 2 files changed, 172 insertions(+), 6 deletions(-) + 2 files changed, 171 insertions(+), 7 deletions(-) diff --git a/extra/libevent/libevent-2.1.11-stable/http-internal.h b/extra/libevent/libevent-2.1.11-stable/http-internal.h -index feaf436..4d52504 100644 +index feaf436d..4d52504c 100644 --- a/extra/libevent/libevent-2.1.11-stable/http-internal.h +++ b/extra/libevent/libevent-2.1.11-stable/http-internal.h @@ -185,6 +185,20 @@ EVENT2_EXPORT_SYMBOL @@ -89,7 +58,7 @@ index feaf436..4d52504 100644 EVENT2_EXPORT_SYMBOL diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c -index 9175bea..765f501 100644 +index 409b02e0..fd9ec9e2 100644 --- a/extra/libevent/libevent-2.1.11-stable/http.c +++ b/extra/libevent/libevent-2.1.11-stable/http.c @@ -123,7 +123,6 @@ @@ -109,7 +78,16 @@ index 9175bea..765f501 100644 #define REQ_VERSION_BEFORE(req, major_v, minor_v) \ ((req)->major < (major_v) || \ ((req)->major == (major_v) && (req)->minor < (minor_v))) -@@ -1899,6 +1900,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) +@@ -920,7 +921,7 @@ evhttp_handle_chunked_read(struct evhttp_request *req, struct evbuffer *buf) + if (req->ntoread < 0) { + /* Read chunk size */ + ev_int64_t ntoread; +- char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF); ++ char *p = evbuffer_readln(buf, NULL, EVBUFFER_EOL_CRLF_STRICT); + char *endp; + int error; + if (p == NULL) +@@ -1907,6 +1908,32 @@ evhttp_find_header(const struct evkeyvalq *headers, const char *key) return (NULL); } @@ -142,11 +120,10 @@ index 9175bea..765f501 100644 void evhttp_clear_headers(struct evkeyvalq *headers) { -@@ -2144,6 +2171,127 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer) - return (errcode); +@@ -2163,6 +2190,125 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer) + return evhttp_parse_headers_impl_(req, buffer, req->input_headers); } -+ +/* Return true if 'ch' is a single linear WS character (per the HTTP spec). + * We reject CR and LF elsewhere. */ +#define IS_LWS(ch) \ @@ -265,12 +242,11 @@ index 9175bea..765f501 100644 + + return 0; +} -+ + static int evhttp_get_body_length(struct evhttp_request *req) { -@@ -2203,8 +2351,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) +@@ -2222,8 +2368,6 @@ evhttp_method_may_have_body(enum evhttp_cmd_type type) static void evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) { @@ -279,7 +255,7 @@ index 9175bea..765f501 100644 /* If this is a request without a body, then we are done */ if (req->kind == EVHTTP_REQUEST && !evhttp_method_may_have_body(req->type)) { -@@ -2212,9 +2358,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) +@@ -2231,9 +2375,8 @@ evhttp_get_body(struct evhttp_connection *evcon, struct evhttp_request *req) return; } evcon->state = EVCON_READING_BODY; @@ -291,7 +267,7 @@ index 9175bea..765f501 100644 req->ntoread = -1; } else { if (evhttp_get_body_length(req) == -1) { -@@ -2300,6 +2445,13 @@ evhttp_read_header(struct evhttp_connection *evcon, +@@ -2319,6 +2462,13 @@ evhttp_read_header(struct evhttp_connection *evcon, return; } @@ -306,5 +282,5 @@ index 9175bea..765f501 100644 if (req->header_cb != NULL) { if ((*req->header_cb)(req, req->cb_arg) < 0) { -- -2.45.4 +2.34.1 diff --git a/SPECS/mysql/mysql.spec b/SPECS/mysql/mysql.spec index 1945d67245c..bfc70cfdc0c 100644 --- a/SPECS/mysql/mysql.spec +++ b/SPECS/mysql/mysql.spec @@ -18,7 +18,8 @@ Patch3: CVE-2025-62813.patch Patch4: CVE-2025-0838.patch # Patch to skip failing ptests on x86 architecture %ifarch x86_64 -Patch5: skip-failing-ptests.patch +Patch5: skip-failing-ptests.patch +%endif Patch6: CVE-2026-63379.patch Patch7: CVE-2026-63381.patch Patch8: CVE-2026-63382.patch @@ -27,7 +28,6 @@ Patch10: CVE-2026-63384.patch Patch11: CVE-2026-63385.patch Patch12: CVE-2026-63387.patch Patch13: CVE-2026-63388.patch -%endif BuildRequires: cmake BuildRequires: libtirpc-devel