[AutoPR- Security] Patch mysql for CVE-2026-63388, CVE-2026-63387, CVE-2026-63385, CVE-2026-63384, CVE-2026-63383, CVE-2026-63382, CVE-2026-63381, CVE-2026-63379 [HIGH]

SPECS/mysql/CVE-2026-63379.patch

@@ -0,0 +1,95 @@
+From b847071141b3827900d536594ec9045eb0a4c485 Mon Sep 17 00:00:00 2001
+From: Nick Mathewson <nickm@torproject.org>
+Date: Fri, 26 Jun 2026 11:04:48 -0400
+Subject: [PATCH] http: Discard trailers.
+
+Previously, we would insert any trailers directly into the header
+list. But this was incorrect, since trailers are not supposed to be
+treated as normal headers.  This behavior could lead to conflicting
+interpretation between HTTP servers and proxies, and enable
+different kinds of attacks.
+
+Fixes GHSA-2gmv-p5m7-98p6.
+
+Reported by @sebastianosrt.
+
+Tracking: X13.
+
+Upstream Patch reference: https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485.patch
+---
+ extra/libevent/libevent-2.1.11-stable/http.c | 25 ++++++++++++++++----
+ 1 file changed, 21 insertions(+), 4 deletions(-)
+
+diff --git a/extra/libevent/libevent-2.1.11-stable/http.c b/extra/libevent/libevent-2.1.11-stable/http.c
+index 5331602a..409b02e0 100644
+--- a/extra/libevent/libevent-2.1.11-stable/http.c
++++ b/extra/libevent/libevent-2.1.11-stable/http.c
+@@ -181,6 +181,10 @@ static evutil_socket_t bind_socket_ai(struct evutil_addrinfo *, int reuse);
+ static evutil_socket_t bind_socket(const char *, ev_uint16_t, int reuse);
+ static void name_from_addr(struct sockaddr *, ev_socklen_t, char **, char **);
+ static struct evhttp_uri *evhttp_uri_parse_authority(char *source_uri);
++static enum message_read_status evhttp_parse_headers_impl_(
++	struct evhttp_request *req,
++	struct evbuffer *buffer,
++	struct evkeyvalq *headers);
+ static int evhttp_associate_new_request_with_connection(
+ 	struct evhttp_connection *evcon);
+ static void evhttp_connection_start_detectclose(
+@@ -988,8 +992,10 @@ static void
+ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req)
+ {
+ 	struct evbuffer *buf = bufferevent_get_input(evcon->bufev);
++	struct evkeyvalq tmp_headers;
++	TAILQ_INIT(&tmp_headers);
+
+-	switch (evhttp_parse_headers_(req, buf)) {
++	switch (evhttp_parse_headers_impl_(req, buf, &tmp_headers)) {
+ 	case DATA_CORRUPTED:
+ 	case DATA_TOO_LONG:
+ 		evhttp_connection_fail_(evcon, EVREQ_HTTP_DATA_TOO_LONG);
+@@ -1003,6 +1009,8 @@ evhttp_read_trailer(struct evhttp_connection *evcon, struct evhttp_request *req)
+ 	default:
+ 		break;
+ 	}
++
++	evhttp_clear_headers(&tmp_headers);
+ }
+
+ static void
+@@ -2083,14 +2091,17 @@ evhttp_append_to_last_header(struct evkeyvalq *headers, char *line)
+ 	return (0);
+ }
+
+-enum message_read_status
+-evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer)
++/* As `evhttp_parse_headers_`, but put any headers we find into `headers`. */
++static enum message_read_status
++evhttp_parse_headers_impl_(
++	struct evhttp_request *req,
++	struct evbuffer *buffer,
++	struct evkeyvalq *headers)
+ {
+ 	enum message_read_status errcode = DATA_CORRUPTED;
+ 	char *line;
+ 	enum message_read_status status = MORE_DATA_EXPECTED;
+
+-	struct evkeyvalq* headers = req->input_headers;
+ 	size_t len;
+ 	while ((line = evbuffer_readln(buffer, &len, EVBUFFER_EOL_CRLF))
+ 	       != NULL) {
+@@ -2146,6 +2157,12 @@ evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer* buffer)
+ 	return (errcode);
+ }
+
++enum message_read_status
++evhttp_parse_headers_(struct evhttp_request *req, struct evbuffer *buffer)
++{
++	return evhttp_parse_headers_impl_(req, buffer, req->input_headers);
++}
++
+ static int
+ evhttp_get_body_length(struct evhttp_request *req)
+ {
+-- 
+2.34.1
+

SPECS/mysql/CVE-2026-63381.patch

@@ -0,0 +1,40 @@
+From 460c0b9d53f46fa865e45f809c6548b209844751 Mon Sep 17 00:00:00 2001
+From: Alexis <alexis.challande@trailofbits.com>
+Date: Tue, 9 Jun 2026 15:09:05 +0200
+Subject: [PATCH] Fix a dangling pointer in evbuffer_add_buffer_reference.
+
+If `evbuffer_add_buffer_reference` was called to add a reference to
+an empty buffer, the resulting code would produce dangling pointers
+that could later lead to a use-after-free.
+
+Fixes GHSA-c2pj-cg4r-88c8.
+
+Tracking: X8.
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/libevent/libevent/commit/5cb95ba2f804f8aff46f88d58391c71e1251cd1c.patch
+---
+ extra/libevent/libevent-2.1.11-stable/buffer.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/extra/libevent/libevent-2.1.11-stable/buffer.c b/extra/libevent/libevent-2.1.11-stable/buffer.c
+index a51b6c5..b878ef6 100644
+--- a/extra/libevent/libevent-2.1.11-stable/buffer.c
++++ b/extra/libevent/libevent-2.1.11-stable/buffer.c
+@@ -1038,8 +1038,13 @@ evbuffer_add_buffer_reference(struct evbuffer *outbuf, struct evbuffer *inbuf)
+
+ 	if (out_total_len == 0) {
+ 		/* There might be an empty chain at the start of outbuf; free
+-		 * it. */
++		 * it.  Reset the chain pointers afterwards so the subsequent
++		 * APPEND_CHAIN_MULTICAST does not dereference the freed chain
++		 * through outbuf->first / last_with_datap. */
+ 		evbuffer_free_all_chains(outbuf->first);
++		outbuf->first = NULL;
++		outbuf->last = NULL;
++		outbuf->last_with_datap = &outbuf->first;
+ 	}
+ 	APPEND_CHAIN_MULTICAST(outbuf, inbuf);
+
+-- 
+2.45.4
+