Commit b66d2aca0f for ffmpeg

commit b66d2aca0fc1b6d23c685c21ecbbca3ad8b32c79
Author: Michael Niedermayer <michael@niedermayer.cc>
Date:   Wed Nov 11 19:22:26 2026 +0100

    avformat/http: reuse a connection only for the host it is connected to

    Fixes: sending credentials to another host
    Fixes: q0uD8AyJRreA
    Regression since: e03b034e45
    Credential disclosure Replicated through UnModified FFmpeg with a local HTTP server

    Found-by: mxyoor

diff --git a/libavformat/http.c b/libavformat/http.c
index a7854122f1..546b591d0c 100644
--- a/libavformat/http.c
+++ b/libavformat/http.c
@@ -343,6 +343,9 @@ static int http_open_cnx_internal(URLContext *h, AVDictionary **options)

     ff_url_join(buf, sizeof(buf), lower_proto, NULL, hostname, port, NULL);

+    if (s->hd && strcmp(s->hd->filename, buf))
+        ffurl_closep(&s->hd);
+
     if (!s->hd) {
         s->nb_connections++;
         err = ffurl_open_whitelist(&s->hd, buf, AVIO_FLAG_READ_WRITE,