[High] Patch rust for CVE-2026-58050, CVE-2026-58051, CVE-2026-66033, CVE-2026-66034, CVE-2026-82251, CVE-2026-82253, CVE-2026-7598, CVE-2026-82252

SPECS/rust/CVE-2026-58050.patch

@@ -0,0 +1,39 @@
+From 34497525929b9a47f03dfb81887ac896202b7e12 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sun, 28 Jun 2026 02:12:52 +0200
+Subject: [PATCH] publickey: fix potential multiplication overflow in 32-bit
+ `libssh2_publickey_list_fetch()`
+
+Cap list size at 1024 elements.
+
+Reported-and-initial-patch-by: Mateusz Gierblinski
+Reported-and-initial-patch-by: Behzod Abdullayev
+Reported-by: Sharique Raza
+
+Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
+
+Closes #2128
+Upstream Patch reference: https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12.patch
+---
+ .../cargo/third-party/libssh2-sys/libssh2/src/publickey.c    | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
+index 87bc894f9..7f1373f22 100644
+--- a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
++++ b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
+@@ -1115,6 +1115,11 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
+                 }
+
+                 if(list[keys].num_attrs) {
++                    if(list[keys].num_attrs > 1024) {
++                        _libssh2_error(session, LIBSSH2_ERROR_OUT_OF_BOUNDARY,
++                                       "Too many publickey attributes");
++                        goto err_exit;
++                    }
+                     list[keys].attrs =
+                         LIBSSH2_ALLOC(session,
+                                       list[keys].num_attrs *
+-- 
+2.43.0
+

SPECS/rust/CVE-2026-58051.patch

@@ -0,0 +1,32 @@
+From a9758da45a52bc8c630ec9493804d0c6ea30b24a Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <vszakats@users.noreply.github.com>
+Date: Mon, 29 Jun 2026 19:12:21 +0200
+Subject: [PATCH] publickey: fix potential arbitrary free in
+ `libssh2_publickey_list_fetch()` (#2127)
+
+Due to uninitialized list entry.
+
+Reported-and-patch-by: Behzod Abdullayev
+Reported-by: Sharique Raza
+
+Follow-up to e15f5d97a04cc676ce117dd324fef85b046207a9
+Upstream Patch reference: https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a.patch
+---
+ src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
+index 9c9fa6188..87bc894f9 100644
+--- a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
++++ b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
+@@ -972,6 +972,7 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
+                     goto err_exit;
+                 }
+                 list = newlist;
++                memset(&list[keys], 0, sizeof(list[keys]));
+             }
+             if(pkey->version == 1) {
+                 unsigned long comment_len;
+-- 
+2.43.0
+

SPECS/rust/CVE-2026-66033.patch

@@ -0,0 +1,45 @@
+From a2ed82d40964bbc0d64cd717aa0a5a892117d2e6 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Thu, 23 Jul 2026 10:32:04 +0200
+Subject: [PATCH] openssl: fix potential OOB read/write with AES-GCM in
+ `ssh2_cipher_crypt()`
+
+By applying two bounds checks to non-debug builds.
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-c4f7-cvfc-33j7
+Follow-up to 3c953c05d67eb1ebcfd3316f279f12c4b1d600b4 #797
+
+Closes #2401
+Upstream Patch reference: https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6.patch
+---
+ .../third-party/libssh2-sys/libssh2/src/openssl.c      | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/openssl.c b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/openssl.c
+index eba05031b..28ae1cc0d 100644
+--- a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/openssl.c
++++ b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/openssl.c
+@@ -1042,13 +1042,15 @@ _libssh2_cipher_crypt(_libssh2_cipher_ctx * ctx,
+     const int aadlen = (is_aesgcm && IS_FIRST(firstlast)) ? 4 : 0;
+     /* size of AT, if present */
+     const int authenticationtag = IS_LAST(firstlast) ? authlen : 0;
+-    /* length to encrypt */
+-    const int cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
++    unsigned int cryptlen; /* length to encrypt */
+
+     (void)algo;
+
+-    assert(blocksize <= sizeof(buf));
+-    assert(cryptlen >= 0);
++    if(blocksize > sizeof(buf) ||
++       blocksize < (size_t)(aadlen + authenticationtag))
++        return 1;
++
++    cryptlen = (unsigned int)blocksize - aadlen - authenticationtag;
+
+ #if LIBSSH2_AES_GCM
+     /* First block */
+-- 
+2.43.0
+

SPECS/rust/CVE-2026-66034.patch

@@ -0,0 +1,36 @@
+From a13bb6c773f0d55ad1628cede57e99803cd898d9 Mon Sep 17 00:00:00 2001
+From: Viktor Szakats <commit@vsz.me>
+Date: Sat, 4 Jul 2026 11:19:49 +0200
+Subject: [PATCH] publickey: fix potential OOB read in
+ `libssh2_publickey_list_fetch()`
+
+Reported-by: Vladimir Eli Tokarev
+Fixes GHSA-w6g9-cpfp-22gc
+
+Closes #2202
+Upstream Patch reference: https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9.patch
+---
+ .../cargo/third-party/libssh2-sys/libssh2/src/publickey.c  | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
+index 7f1373f22..e680999fd 100644
+--- a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
++++ b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/publickey.c
+@@ -989,6 +989,13 @@ libssh2_publickey_list_fetch(LIBSSH2_PUBLICKEY * pkey, unsigned long *num_keys,
+                 }
+
+                 if(comment_len) {
++                    if(pkey->listFetch_s + comment_len >
++                       pkey->listFetch_data + pkey->listFetch_data_len) {
++                        _libssh2_error(session, LIBSSH2_ERROR_BUFFER_TOO_SMALL,
++                                       "ListFetch data too short");
++                        goto err_exit;
++                    }
++
+                     list[keys].num_attrs = 1;
+                     list[keys].attrs =
+                         LIBSSH2_ALLOC(session,
+-- 
+2.43.0
+

SPECS/rust/CVE-2026-7598.patch

@@ -0,0 +1,56 @@
+From 256d04b60d80bf1190e96b0ad1e91b2174d744b1 Mon Sep 17 00:00:00 2001
+From: Will Cosgrove <will@panic.com>
+Date: Mon, 13 Apr 2026 11:18:25 -0700
+Subject: [PATCH] userauth.c: username_len bounds checking (#1858)
+
+Return errors when username_len will exceed bounds, fix existing bounds
+check.
+
+Credit:
+[dapickle](https://github.com/dapickle)
+Upstream Patch reference: https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch
+---
+ .../third-party/libssh2-sys/libssh2/src/userauth.c  | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/userauth.c b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/userauth.c
+index 0040c3fa3..588b83f24 100644
+--- a/src/tools/cargo/third-party/libssh2-sys/libssh2/src/userauth.c
++++ b/src/tools/cargo/third-party/libssh2-sys/libssh2/src/userauth.c
+@@ -80,6 +80,12 @@ static char *userauth_list(LIBSSH2_SESSION *session, const char *username,
+         memset(&session->userauth_list_packet_requirev_state, 0,
+                sizeof(session->userauth_list_packet_requirev_state));
+
++        if(username_len > UINT32_MAX - 27) {
++            _libssh2_error(session, LIBSSH2_ERROR_PROTO,
++                           "username_len out of bounds");
++            return NULL;
++        }
++
+         session->userauth_list_data_len = username_len + 27;
+
+         s = session->userauth_list_data =
+@@ -307,6 +313,11 @@ userauth_password(LIBSSH2_SESSION *session,
+          * 40 = packet_type(1) + username_len(4) + service_len(4) +
+          * service(14)"ssh-connection" + method_len(4) + method(8)"password" +
+          * chgpwdbool(1) + password_len(4) */
++        if(username_len > UINT32_MAX - 40) {
++            return _libssh2_error(session, LIBSSH2_ERROR_PROTO,
++                                  "username_len out of bounds");
++        }
++
+         session->userauth_pswd_data_len = username_len + 40;
+
+         session->userauth_pswd_data0 =
+@@ -447,7 +458,7 @@ password_response:
+                         }
+
+                         /* basic data_len + newpw_len(4) */
+-                        if(username_len + password_len + 44 <= UINT_MAX) {
++                        if(username_len <= UINT32_MAX - password_len - 44) {
+                             session->userauth_pswd_data_len =
+                                 username_len + password_len + 44;
+                             s = session->userauth_pswd_data =
+-- 
+2.43.0
+

SPECS/rust/CVE-2026-82253.patch

@@ -0,0 +1,49 @@
+From d2e193fe6ecbf98a1db83895d348abb6fc565422 Mon Sep 17 00:00:00 2001
+From: "GPT 5.4" <codex@openai.com>
+Date: Thu, 23 Apr 2026 17:42:19 +0800
+Subject: [PATCH] fix(gix-submodule): don't follow submodule names with
+ relative paths in them
+
+This made it possible to trick submodule repos to be opened outside of the
+actual repository.
+
+Co-authored-by: Sebastian Thiel <sebastian.thiel@icloud.com>
+Upstream Patch reference: https://github.com/GitoxideLabs/gitoxide/commit/d2e193fe6ecbf98a1db83895d348abb6fc565422.patch
+---
+ vendor/gix-validate-0.11.0/.cargo-checksum.json |  2 +-
+ vendor/gix-validate-0.11.0/src/submodule.rs     | 13 ++++---------
+ 2 files changed, 5 insertions(+), 10 deletions(-)
+
+diff --git a/vendor/gix-validate-0.11.0/.cargo-checksum.json b/vendor/gix-validate-0.11.0/.cargo-checksum.json
+index 130f43a..3882ed6 100644
+--- a/vendor/gix-validate-0.11.0/.cargo-checksum.json
++++ b/vendor/gix-validate-0.11.0/.cargo-checksum.json
+@@ -1 +1 @@
+-{"files":{".cargo_vcs_info.json":"695f79305052fc6e1a5c9115919f7726f8751bdf78e7ca33915c504024b50a53","Cargo.lock":"5df5d5c53c49e75c947300b3cba4caa918135b7fe7a078e1a8d174543fdea26b","Cargo.toml":"e088900466c4cd903617d4038a046d7a6afa50087ca973d8c636cbb2d4ff4871","Cargo.toml.orig":"ec3e95d2d8b25b6eded08c8b37014623e54cf85b37968497ae6306540fd4fea3","LICENSE-APACHE":"0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594","LICENSE-MIT":"f9c4c77baa3828004ee54b8a4f2db2e88ed44a6237a493965bf551fac0fcb62d","src/lib.rs":"d5fc5f3d25a9e0ed254b327e3715b07cb17f446d318a5c7928f2bb7e1ddcb0ed","src/path.rs":"138b2ad02c4407c7d49ccc5f0fd61f1648473160f30a06125a31ee4d193a6830","src/reference.rs":"eea2f9d2bb10e4441b02ab094f1b1bb3c9d0fa0cb1823fed8f0f21bc0ee124cb","src/submodule.rs":"f1b95a3626045ce5bbb55e2bc13d0e2799380e8467993f997864ec2c004b1225","src/tag.rs":"637c67f706573da76bf3af90c30dbb30fe5aa88ed2447041676ff7a44cab4bf4"},"package":"0ec1eff98d91941f47766367cba1be746bab662bad761d9891ae6f7882f7840b"}
+\ No newline at end of file
++{"files":{".cargo_vcs_info.json":"695f79305052fc6e1a5c9115919f7726f8751bdf78e7ca33915c504024b50a53","Cargo.lock":"5df5d5c53c49e75c947300b3cba4caa918135b7fe7a078e1a8d174543fdea26b","Cargo.toml":"e088900466c4cd903617d4038a046d7a6afa50087ca973d8c636cbb2d4ff4871","Cargo.toml.orig":"ec3e95d2d8b25b6eded08c8b37014623e54cf85b37968497ae6306540fd4fea3","LICENSE-APACHE":"0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594","LICENSE-MIT":"f9c4c77baa3828004ee54b8a4f2db2e88ed44a6237a493965bf551fac0fcb62d","src/lib.rs":"d5fc5f3d25a9e0ed254b327e3715b07cb17f446d318a5c7928f2bb7e1ddcb0ed","src/path.rs":"138b2ad02c4407c7d49ccc5f0fd61f1648473160f30a06125a31ee4d193a6830","src/reference.rs":"eea2f9d2bb10e4441b02ab094f1b1bb3c9d0fa0cb1823fed8f0f21bc0ee124cb","src/submodule.rs":"4a7dbced6123f042f0be1f9e743de755f0c94dc722385c2ea498c74eea5187f1","src/tag.rs":"637c67f706573da76bf3af90c30dbb30fe5aa88ed2447041676ff7a44cab4bf4"},"package":"0ec1eff98d91941f47766367cba1be746bab662bad761d9891ae6f7882f7840b"}
+\ No newline at end of file
+diff --git a/vendor/gix-validate-0.11.0/src/submodule.rs b/vendor/gix-validate-0.11.0/src/submodule.rs
+index c20c642..48027a7 100644
+--- a/vendor/gix-validate-0.11.0/src/submodule.rs
++++ b/vendor/gix-validate-0.11.0/src/submodule.rs
+@@ -28,15 +28,10 @@ pub fn name(name: &BStr) -> Result<&BStr, name::Error> {
+     if name.is_empty() {
+         return Err(name::Error::Empty);
+     }
+-    match name.find(b"..") {
+-        Some(pos) => {
+-            let &b = name.get(pos + 2).ok_or(name::Error::ParentComponent)?;
+-            if b == b'/' || b == b'\\' {
+-                Err(name::Error::ParentComponent)
+-            } else {
+-                Ok(name)
+-            }
++    for component in name.as_bytes().split(|b| *b == b'/' || *b == b'\\') {
++        if component == b".." {
++            return Err(name::Error::ParentComponent);
+         }
+-        None => Ok(name),
+     }
++    Ok(name)
+ }

SPECS/rust/rust.spec

@@ -9,7 +9,7 @@
 Summary:        Rust Programming Language
 Name:           rust
 Version:        1.96.1
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        (ASL 2.0 OR MIT) AND BSD AND CC-BY-3.0
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -46,6 +46,14 @@ Patch7:         CVE-2026-2006.patch
 Patch8:         CVE-2026-34743.patch
 Patch9:         CVE-2026-40034.patch
 Patch10:        CVE-2026-47143.patch
+Patch11:        CVE-2026-58051.patch
+Patch12:        CVE-2026-58050.patch
+Patch13:        CVE-2026-66034.patch
+Patch14:        CVE-2026-66033.patch
+Patch15:        CVE-2026-7598.patch
+Patch16:        CVE-2026-82251.patch
+Patch17:        CVE-2026-82252.patch
+Patch18:        CVE-2026-82253.patch
 
 # Note: the stage0 bootstrap toolchain (cargo/rustc/rust-std tarballs) is packaged
 # separately in rust-bootstrap, to keep this SRPM's size down. See SPECS/rust-bootstrap.
@@ -214,6 +222,10 @@ find %{buildroot}%{_libdir}/rustlib/src -type f -name '*.py' -exec rm -v '{}' '+
 %{_libdir}/rustlib/src
 
 %changelog
+* Tue Sep 01 2026 BinduSri Adabala <v-badabala@microsoft.com> - 1.96.1-2
+- Add patch for CVE-2026-58051, CVE-2026-58050, CVE-2026-66034, CVE-2026-66033,
+  CVE-2026-7598, CVE-2026-82251, CVE-2026-82252, CVE-2026-82253
+
 * Wed Aug 19 2026 Kavya Sree Kaitepalli <kkaitepalli@microsoft.com> - 1.96.1-1
 - Move stage0 bootstrap toolchain tarballs (cargo/rustc/rust-std) out of this
   SRPM into a new rust-bootstrap BuildRequires package, to keep this SRPM small.