curl: fix CVE-2026-4873

This patch applies the upstream backport for CVE-2026-4873.
The upstream fix commit is referenced in [1], and the public
CVE advisory is referenced in [2].

[1] 507e7be573
[2] https://curl.se/docs/CVE-2026-4873.html

(From OE-Core rev: dfd15b80d4e69de4979f56e0bf6cbd095415a30c)

Signed-off-by: Deepak Rathore <deeratho@cisco.com>
Signed-off-by: Fabien Thomas <fabien.thomas@smile.fr>
Signed-off-by: Paul Barker <paul@pbarker.dev>

meta/recipes-support/curl/curl/CVE-2026-4873.patch

@@ -0,0 +1,58 @@
+From a7e6dd14ee3900226066819a0334defb58c52486 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Tue, 28 Jul 2026 04:35:55 -0700
+Subject: [PATCH] url: do not reuse a non-tls starttls connection if new
+ requires TLS
+
+Reported-by: Arkadi Vainbrand
+
+Closes #21082
+
+CVE: CVE-2026-4873
+Upstream-Status: Backport [https://github.com/curl/curl/commit/507e7be573b0a76fca597b75ff7cb27a66e7d865]
+
+Backport Changes:
+- Upstream adds req_tls to struct url_conn_match, sets match.req_tls in
+  url_attach_existing(), and enforces it in url_match_ssl_use() when a
+  clear-text requested scheme is matched with a candidate connection
+  that is not actually using TLS.
+- Scarthgap curl 8.7.1 does not have struct url_conn_match or the
+  url_attach_existing()/url_match_ssl_use() split. The equivalent reuse
+  matching still happens directly in ConnectionExists(), so this backport
+  keeps the same state in a local req_tls variable derived from
+  data->set.use_ssl.
+- The rejection check is placed after the general SSL compatibility
+  check and uses Curl_conn_is_ssl(check, FIRSTSOCKET). This preserves
+  valid implicit-TLS IMAPS/POP3S/SMTPS reuse while still rejecting a
+  clear-text STARTTLS-capable cached connection for a request that
+  requires TLS.
+
+(cherry picked from commit 507e7be573b0a76fca597b75ff7cb27a66e7d865)
+Signed-off-by: Deepak Rathore <deeratho@cisco.com>
+---
+ lib/url.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/url.c b/lib/url.c
+index 30f215f..c4c5982 100644
+--- a/lib/url.c
++++ b/lib/url.c
+@@ -935,6 +935,7 @@ ConnectionExists(struct Curl_easy *data,
+   /* plain HTTP with upgrade */
+   bool h2upgrade = (data->state.httpwant == CURL_HTTP_VERSION_2_0) &&
+     (needle->handler->protocol & CURLPROTO_HTTP);
++  bool req_tls = data->set.use_ssl >= CURLUSESSL_CONTROL;
+ 
+   *usethis = NULL;
+   *force_reuse = FALSE;
+@@ -1052,6 +1053,10 @@ ConnectionExists(struct Curl_easy *data,
+         /* except protocols that have been upgraded via TLS */
+         continue;
+ 
++    if(!(needle->handler->flags & PROTOPT_SSL) &&
++       req_tls && !Curl_conn_is_ssl(check, FIRSTSOCKET))
++      continue;
++
+     if(needle->bits.conn_to_host != check->bits.conn_to_host)
+       /* don't mix connections that use the "connect to host" feature and
+        * connections that don't use this feature */

meta/recipes-support/curl/curl_8.7.1.bb

@@ -40,6 +40,7 @@ SRC_URI = " \
     file://CVE-2026-6276.patch \
     file://CVE-2026-5545.patch \
     file://CVE-2026-6253.patch \
+    file://CVE-2026-4873.patch \
 "
 
 SRC_URI:append:class-nativesdk = " \