fix(cve): CVE-2026-9080 - multi: handle pause in multi socket callback

[deepin-ci-robot]

CVE: CVE-2026-9080 (high) - Handle pause in multi socket callback to prevent use-after-free when curl_easy_pause() is called from within the socket callback
Upstream: curl/curl@5ab34cb

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-10536 (critical) - A use-after-free vulnerability exists in libcurl when an application configures an HTTP/2 stream-dependency tree via CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, subsequently invokes curl_easy_reset(), and finally terminates the handle with curl_easy_cleanup().
Upstream: curl/curl@bfbff78

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-8925 (critical) - gsasl: fix potential double free
Upstream: curl/curl@3da249e

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-8927 (critical) - URL: 检测从环境变量读取的代理配置变更
Upstream: curl/curl@5c22538

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-9079 (critical) - 安全修复
Upstream: curl/curl@88c7e16

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-11856 (critical) - 成功使用 libcurl 对特定 HTTP 源（hostA）进行 Digest 认证传输，然后将源更改为不同的源（hostB）进行第二次传输，重用相同的句柄，会导致 libcurl 错误地将原本用于 hostA 的 Authorization: 头字段传递给 hostB
Upstream: curl/curl@5c6b488

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-8924 (critical) - A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
Upstream: curl/curl@51beed175dbfc37da3113f6acc

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-8286 (high) - 安全修复
Upstream: curl/curl@a86efdd

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-9545 (high) - ngtcp2: 证书验证失败时直接终止握手
Upstream: curl/curl@7b9613f

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-9547 (high) - When a libcurl-based application performs transfers via SCP:// or SFTP:// and utilizes the CURLOPT_SSH_KEYFUNCTION callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the known_hosts file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack.
Upstream: curl/curl@0b8dbbc

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-11352 (high) - An issue in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client.
Upstream: curl/curl@6a3d0b6

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-11586 (high) - WebSocket pong sending is not lazy, which can cause issues when a server is lazy in reading data and intermediary PONG frames can be skipped by a client (RFC 6455, ch. 5.5.3).
Upstream: curl/curl@849317f

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-8932 (high) - cert_type, key, key_type, key_passwd and key_blob lived in ssl_config_data but not in ssl_primary_config, so they were invisible to match_ssl_primary_config() and to the TLS session cache peer key. Two easy handles sharing a connection pool could reuse each other's authenticated connections when they differed only on SSLKEY, SSLKEYTYPE, KEEYPASSWD, SSLCERTTYPE or SSLKEYBLOB. The second handle would silently inherit the first handle's authenticated identity.
Upstream: curl/curl@7541ae5

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2026-12064 (high) - 修复了 curl 在设置默认协议时的逻辑错误，确保 --proto-default 选项能够正确使用默认协议而不进行协议猜测。
Upstream: curl/curl@ab3bb8c

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

---

CVE: CVE-2025-11563 (medium) - 包含百分号编码斜杠（/或\）的URL可以欺骗wcurl将输出文件保存到当前目录之外，而无需用户明确请求。此缺陷仅影响wcurl命令行工具。
Upstream: curl/curl@79d3e1d

Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tsic404 for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• https:/raw.githubusercontent.com/deepin-community/template-repository/master/debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

TAG Bot

TAG: 8.14.1-2+deb13u4deepin18
EXISTED: no
DISTRIBUTION: unstable

[deepin-ci-robot]

/hold
因为该quilt包的上游版本号变更，详情见: deepin-community/infra-settings#134