DEBIAN-CVE-2026-92389 - curl/curl
The TFTP transfer state machine accepted server responses for the wrong direction (e.g. DATA during upload). Backport of upstream 63dd390f to 8.14.1. Regression coverage is the libtest lib5036c harness driven by tests/data/test5036.
Evidence
- regression test tests/libtest/lib5036 + tests/data/test5036 RED on revert, GREEN on fix (adversarial re-review PASS)
- conflict resolution kept test5035 + test5036 lines, targeted checks clean
History
- 2026-10-28: Fixed in fork - merged to fork master 2f63b75