fix(cve): CVE-2026-105326 - Fix regression in mailto address validati…

debian/changelog

@@ -51,6 +51,12 @@ cups (2.4.16-1deepin21) unstable; urgency=medium
     addresses and fix sendmail usage (GHSA-r4wf-366f-f6g3)   Upstream:
     https://github.com/OpenPrinting/cups/commit/611d1bd3bdf8323638323835
     67906a6d7fd6c47d
+  * fix(cve): CVE-2026-105326 - Fix regression in mailto address
+    validation (Issue #1744): addresses containing a period, such as
+    "user@example.com", were rejected so no notification was sent.
+    Upstream:
+    https://github.com/OpenPrinting/cups/commit/4c5a15599ccbbc2d3b69b06
+    190a44b85321c3211
 
  -- deepin-ci-robot <packages@deepin.org>  Wed, 21 Oct 2026 02:00:51 +0800
 

debian/patches/CVE-2026-105326-fix-mailto-validation.patch

@@ -0,0 +1,35 @@
+Description: Fix mailto address validation regression (Issue #1744)
+ The address validation loop added for CVE-2026-105326 (GHSA-r4wf-366f-f6g3)
+ rejects every address containing a period: the "consecutive periods" test
+ is an "else if" that falls through to the allowed-character test, where '.'
+ is not listed. Valid recipients such as "user@example.com" therefore fail
+ validation and the mailto notifier sends no notification at all.
+ Handle "." in its own branch and reject only leading, consecutive and
+ post-'@' periods.
+Author: Michael R Sweet <msweet@msweet.org>
+Origin: https://github.com/OpenPrinting/cups/commit/4c5a15599ccbbc2d3b69b06190a44b85321c3211
+Bug: https://github.com/OpenPrinting/cups/issues/1744
+Last-Update: 2026-10-06
+---
+
+diff --git a/notifier/mailto.c b/notifier/mailto.c
+index 2f118a67..fe0aa58f 100644
+--- a/notifier/mailto.c
++++ b/notifier/mailto.c
+@@ -262,13 +262,14 @@ copy_validate_address(
+
+       saw_at = 1;
+     }
+-    else if (*bufptr == '.' && (bufptr == buffer || bufptr[-1] == '.' || bufptr[-1] == '@'))
++    else if (*bufptr == '.')
+     {
+      /*
+       * dot-atom-text doesn't allow consecutive periods...
+       */
+
+-      goto bad_address;
++      if (bufptr == buffer || bufptr[-1] == '.' || bufptr[-1] == '@')
++	goto bad_address;
+     }
+     else if (!strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
+                      "0123456789!#$%&\'*+-/=?^_`{|}~", *bufptr))

debian/patches/series

@@ -42,3 +42,4 @@ CVE-2026-55453.patch
 CVE-2026-87875.patch
 CVE-2026-107655.patch
 CVE-2026-105326.patch
+CVE-2026-105326-fix-mailto-validation.patch