Vulnerability-Lookup

CVE-2025-9086 (GCVE-0-2025-9086)

Vulnerability from cvelistv5 – Published: 2025-09-12 05:10 – Updated: 2026-09-15 06:02

Title

Out of bounds read for cookie path

Summary

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-12 17:15 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

curl redhat root

References

7 references

URL	Tags
https://curl.se/docs/CVE-2025-9086.json
https://curl.se/docs/CVE-2025-9086.html
https://hackerone.com/reports/3294999
http://www.openwall.com/lists/oss-security/2025/09/10/1
https://lists.debian.org/debian-lts-announce/2026…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

20 products

Vendor	Product	Version	CPE status
curl	curl	Affected: 8.13.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.0 (semver)	guessed
curl	curl	Affected: 1aea05a6c2699e80c75936d58569851555acd603 , < c6ae07c6a541e0e96d0040afb62b45dd37711300 (git)	guessed
curl	curl	Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0	guessed
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.3 (custom)	guessed
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)	guessed
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XCH328	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XCM324	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XCM328	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XCM332	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRH334 (24 V DC, 8xFO, CC)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (24 V DC, 12xFO)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (24 V DC, 8xFO)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (2x230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (2x230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)	guessed
Siemens	SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)	guessed

Credits

Google Big Sleep Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-9086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T17:15:47.921625Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-12T17:16:20.317Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-05T02:47:38.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:59:46.514Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300",
              "status": "affected",
              "version": "1aea05a6c2699e80c75936d58569851555acd603",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:35.281Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-9086.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-9086.html"
        },
        {
          "url": "https://hackerone.com/reports/3294999"
        }
      ],
      "title": "Out of bounds read for cookie path",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "8.13.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "1aea05a6c2699e80c75936d58569851555acd603"
                  },
                  {
                    "fixed": "c6ae07c6a541e0e96d0040afb62b45dd37711300"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-9086"
        ],
        "credits": [
          {
            "name": "Google Big Sleep",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Out-of-bounds Read",
            "id": "CWE-125"
          },
          "URL": "https://curl.se/docs/CVE-2025-9086.json",
          "affects": "lib",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "issue": "https://hackerone.com/reports/3294999",
          "last_affected": "8.15.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-9086.html"
        },
        "details": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.",
        "id": "CURL-CVE-2025-9086",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2025-09-10T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "Out of bounds read for cookie path"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-9086",
    "datePublished": "2025-09-12T05:10:03.815Z",
    "dateReserved": "2025-08-16T05:40:23.800Z",
    "dateUpdated": "2026-09-15T06:02:35.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-9086",
      "date": "2026-09-19",
      "epss": "0.01395",
      "percentile": "0.71173"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:38:38.000Z",
      "cve": "CVE-2025-9086",
      "id": "msrc_CVE-2025-9086",
      "initial_release_date": "2025-09-02T00:00:00.000Z",
      "product_status:known_affected": "11",
      "product_status:known_not_affected": "11",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Out of bounds read for cookie path",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-9086.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "8.14.2",
                    "status": "affected",
                    "version": "8.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "8.16.0",
                    "status": "affected",
                    "version": "8.15.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "repo": "https://github.com/curl/curl.git",
                "vendor": "curl",
                "versions": [
                  {
                    "lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300",
                    "status": "affected",
                    "version": "1aea05a6c2699e80c75936d58569851555acd603",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "curl",
                "vendor": "curl",
                "versions": [
                  {
                    "status": "affected",
                    "version": "8.15.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.14.1"
                  },
                  {
                    "status": "affected",
                    "version": "8.14.0"
                  },
                  {
                    "status": "affected",
                    "version": "8.13.0"
                  }
                ]
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9"
          },
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM RST2428P",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM RST2428P",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V4.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCH328",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCM324",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCM328",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCM332",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4979D5F1-8D49-4EC0-AC6B-230636A10C34",
                    "versionEndExcluding": "8.16.0",
                    "versionStartIncluding": "8.13.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
          }
        ],
        "id": "CVE-2025-9086",
        "lastModified": "2026-09-14T21:16:59.523",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-9086",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T17:15:47.921625Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-09-12T06:15:44.100",
        "references": [
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2025-9086.html"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://curl.se/docs/CVE-2025-9086.json"
          },
          {
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://hackerone.com/reports/3294999"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T11:51:54+00:00",
      "cve": "CVE-2025-9086",
      "id": "CVE-2025-9086",
      "initial_release_date": "2025-09-12T05:10:03.815000+00:00",
      "product_status:fixed": "319",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "211",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "curl: libcurl: Curl out of bounds read for cookie path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9086.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-16T00:19:36Z",
      "cve": "CVE-2025-9086",
      "id": "CVE-2025-9086",
      "initial_release_date": "2025-09-10T23:27:12Z",
      "product_status:first_fixed": "13",
      "product_status:known_affected": "372",
      "product_status:known_not_affected": "59",
      "product_status:recommended": "237",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-9086",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-9086.json",
      "version": "38"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-01-05T02:47:38.406Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM RST2428P",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "RUGGEDCOM RST2428P",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V4.0",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCH328",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCM324",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCM328",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XCM332",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "V3.3",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-02T12:59:46.514Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
              },
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.5,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-9086",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-09-12T17:15:47.921625Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-09-12T17:16:09.204Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "lessThan": "8.14.2",
                  "status": "affected",
                  "version": "8.13.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "8.16.0",
                  "status": "affected",
                  "version": "8.15.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "repo": "https://github.com/curl/curl.git",
              "vendor": "curl",
              "versions": [
                {
                  "lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300",
                  "status": "affected",
                  "version": "1aea05a6c2699e80c75936d58569851555acd603",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "curl",
              "vendor": "curl",
              "versions": [
                {
                  "status": "affected",
                  "version": "8.15.0"
                },
                {
                  "status": "affected",
                  "version": "8.14.1"
                },
                {
                  "status": "affected",
                  "version": "8.14.0"
                },
                {
                  "status": "affected",
                  "version": "8.13.0"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Google Big Sleep"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Daniel Stenberg"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "Out-of-bounds Read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T06:02:35.281Z",
            "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
            "shortName": "curl"
          },
          "references": [
            {
              "url": "https://curl.se/docs/CVE-2025-9086.json"
            },
            {
              "url": "https://curl.se/docs/CVE-2025-9086.html"
            },
            {
              "url": "https://hackerone.com/reports/3294999"
            }
          ],
          "title": "Out of bounds read for cookie path",
          "x_generator": {
            "engine": "cvelib 1.8.0"
          },
          "x_osv": {
            "affected": [
              {
                "ranges": [
                  {
                    "events": [
                      {
                        "introduced": "8.13.0"
                      },
                      {
                        "fixed": "8.14.2"
                      },
                      {
                        "introduced": "8.15.0"
                      },
                      {
                        "fixed": "8.16.0"
                      }
                    ],
                    "type": "SEMVER"
                  },
                  {
                    "events": [
                      {
                        "introduced": "1aea05a6c2699e80c75936d58569851555acd603"
                      },
                      {
                        "fixed": "c6ae07c6a541e0e96d0040afb62b45dd37711300"
                      }
                    ],
                    "repo": "https://github.com/curl/curl.git",
                    "type": "GIT"
                  }
                ],
                "versions": [
                  "8.15.0",
                  "8.14.1",
                  "8.14.0",
                  "8.13.0"
                ]
              }
            ],
            "aliases": [
              "CVE-2025-9086"
            ],
            "credits": [
              {
                "name": "Google Big Sleep",
                "type": "finder"
              },
              {
                "name": "Daniel Stenberg",
                "type": "remediation developer"
              }
            ],
            "database_specific": {
              "CWE": {
                "desc": "Out-of-bounds Read",
                "id": "CWE-125"
              },
              "URL": "https://curl.se/docs/CVE-2025-9086.json",
              "affects": "lib",
              "award": {
                "amount": "505",
                "currency": "USD"
              },
              "issue": "https://hackerone.com/reports/3294999",
              "last_affected": "8.15.0",
              "package": "curl",
              "severity": "Low",
              "www": "https://curl.se/docs/CVE-2025-9086.html"
            },
            "details": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.",
            "id": "CURL-CVE-2025-9086",
            "modified": "2026-09-07T10:34:51.00Z",
            "published": "2025-09-10T08:00:00.00Z",
            "schema_version": "1.5.0",
            "summary": "Out of bounds read for cookie path"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "assignerShortName": "curl",
        "cveId": "CVE-2025-9086",
        "datePublished": "2025-09-12T05:10:03.815Z",
        "dateReserved": "2025-08-16T05:40:23.800Z",
        "dateUpdated": "2026-09-15T06:02:35.281Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

NCSC-2026-0032

Vulnerability from csaf_ncscnl - Published: 2026-01-21 10:12 - Updated: 2026-01-21 10:12

Summary

Kwetsbaarheden verholpen in Oracle MySQL

Scope

15 vulnerabilities in this advisory, including CVE-2025-9086.

CVE-2025-9086

Recent updates to curl and MySQL Enterprise Backup address critical vulnerabilities, including cookie path issues and denial of service risks in various software versions.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Known affected: 6 products

Open the full advisory

OESA-2025-2319 (CVE-2025-9086)

Vulnerability from osv_openeuler – Published: 2025-09-19 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

curl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path="/", a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-9086	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-42.oe2203sp3.aarch64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp3.aarch64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp3.aarch64.rpm",
          "libcurl-7.79.1-42.oe2203sp3.aarch64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-42.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-42.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-42.oe2203sp3.x86_64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp3.x86_64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp3.x86_64.rpm",
          "libcurl-7.79.1-42.oe2203sp3.x86_64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-42.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-42.oe2203sp4.aarch64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp4.aarch64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp4.aarch64.rpm",
          "libcurl-7.79.1-42.oe2203sp4.aarch64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-42.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-42.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-42.oe2203sp4.x86_64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp4.x86_64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp4.x86_64.rpm",
          "libcurl-7.79.1-42.oe2203sp4.x86_64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-42.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-22.oe2403.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403.aarch64.rpm",
          "curl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-22.oe2403.noarch.rpm",
          "curl-help-8.4.0-22.oe2403sp1.noarch.rpm",
          "curl-help-8.4.0-22.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-22.oe2403.src.rpm",
          "curl-8.4.0-22.oe2403sp1.src.rpm",
          "curl-8.4.0-22.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-22.oe2403.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403.x86_64.rpm",
          "curl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-22.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-22.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-22.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-22.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-22.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-22.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-22.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.71.1-43.oe2003sp4.aarch64.rpm",
          "curl-debuginfo-7.71.1-43.oe2003sp4.aarch64.rpm",
          "curl-debugsource-7.71.1-43.oe2003sp4.aarch64.rpm",
          "libcurl-7.71.1-43.oe2003sp4.aarch64.rpm",
          "libcurl-devel-7.71.1-43.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.71.1-43.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "curl-7.71.1-43.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "curl-7.71.1-43.oe2003sp4.x86_64.rpm",
          "curl-debuginfo-7.71.1-43.oe2003sp4.x86_64.rpm",
          "curl-debugsource-7.71.1-43.oe2003sp4.x86_64.rpm",
          "libcurl-7.71.1-43.oe2003sp4.x86_64.rpm",
          "libcurl-devel-7.71.1-43.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.71.1-43.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\ncurl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path=\u0026quot;/\u0026quot;, a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)",
  "id": "OESA-2025-2319",
  "modified": "2026-08-06T11:09:23Z",
  "published": "2025-09-19T11:09:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2319"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2025-9086"
  ]
}

OPENSUSE-SU-2025-20090-1

Vulnerability from csaf_opensuse - Published: 2025-11-26 14:30 - Updated: 2025-11-26 14:30

Summary

Security update for curl

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2025-9086.

CVE-2025-9086

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 15 products

Open the full advisory

OPENSUSE-SU-2025:15590-1

Vulnerability from csaf_opensuse - Published: 2025-10-01 00:00 - Updated: 2026-09-15 08:59

Summary

curl-8.16.0-1.1 on GA media

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2025-9086.

CVE-2025-9086

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 36 products

Open the full advisory

OPENSUSE-SU-2025:20090-1

Vulnerability from csaf_opensuse - Published: 2025-11-26 14:30 - Updated: 2026-09-15 08:59

Summary

Security update for curl

Severity

Important

Scope

3 vulnerabilities in this advisory, including CVE-2025-9086.

CVE-2025-9086

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 15 products

Open the full advisory

RHSA-2025:23043

Vulnerability from csaf_opensuse - Published: 2025-12-10 00:00 - Updated: 2026-09-15 08:44

Summary

security update for curl

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9086.

CVE-2025-9086

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 8 products

Open the full advisory

RHSA-2025:23383

Vulnerability from csaf_opensuse - Published: 2025-12-16 00:00 - Updated: 2026-09-15 08:44

Summary

security update for curl

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9086.

CVE-2025-9086

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Recommended: 7 products

Open the full advisory

RHSA-2025:23125

Vulnerability from csaf_redhat - Published: 2025-12-11 13:00 - Updated: 2026-09-01 11:57

Summary

Red Hat Security Advisory: curl security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9086.

CVE-2025-9086

An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fixed: 18 products Known not affected: 56 products

https://access.redhat.com/errata/RHSA-2025:23125

Open the full advisory

RHSA-2025:23126

Vulnerability from csaf_redhat - Published: 2025-12-11 13:25 - Updated: 2026-09-01 11:57

Summary

Red Hat Security Advisory: curl security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9086.

CVE-2025-9086

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fixed: 18 products Known not affected: 56 products

https://access.redhat.com/errata/RHSA-2025:23126

Open the full advisory

RHSA-2025:23127

Vulnerability from csaf_redhat - Published: 2025-12-11 13:44 - Updated: 2026-09-01 11:57

Summary

Red Hat Security Advisory: curl security update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2025-9086.

CVE-2025-9086

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fixed: 18 products Known not affected: 56 products

https://access.redhat.com/errata/RHSA-2025:23127

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-9086 (GCVE-0-2025-9086)

OESA-2025-2319 (CVE-2025-9086)

Tags

Sightings

Nomenclature

Related by attack behaviour