Vulnerability-Lookup

OESA-2025-2319 (CVE-2025-9086)

Vulnerability from osv_openeuler – Published: 2025-09-19 11:09 – Updated: 2026-08-06 11:09 – Source website

Summary

curl security update

Details

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

curl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path="/", a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-9086	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-42.oe2203sp3.aarch64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp3.aarch64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp3.aarch64.rpm",
          "libcurl-7.79.1-42.oe2203sp3.aarch64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-42.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-42.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-42.oe2203sp3.x86_64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp3.x86_64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp3.x86_64.rpm",
          "libcurl-7.79.1-42.oe2203sp3.x86_64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-42.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.79.1-42.oe2203sp4.aarch64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp4.aarch64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp4.aarch64.rpm",
          "libcurl-7.79.1-42.oe2203sp4.aarch64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.79.1-42.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "curl-7.79.1-42.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "curl-7.79.1-42.oe2203sp4.x86_64.rpm",
          "curl-debuginfo-7.79.1-42.oe2203sp4.x86_64.rpm",
          "curl-debugsource-7.79.1-42.oe2203sp4.x86_64.rpm",
          "libcurl-7.79.1-42.oe2203sp4.x86_64.rpm",
          "libcurl-devel-7.79.1-42.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.79.1-42.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-22.oe2403.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403.aarch64.rpm",
          "curl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-22.oe2403.noarch.rpm",
          "curl-help-8.4.0-22.oe2403sp1.noarch.rpm",
          "curl-help-8.4.0-22.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-22.oe2403.src.rpm",
          "curl-8.4.0-22.oe2403sp1.src.rpm",
          "curl-8.4.0-22.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-22.oe2403.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403.x86_64.rpm",
          "curl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-22.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-22.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-22.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp1.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp1.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-22.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.aarch64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.aarch64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-8.4.0-22.oe2403sp2.noarch.rpm"
        ],
        "src": [
          "curl-8.4.0-22.oe2403sp2.src.rpm"
        ],
        "x86_64": [
          "curl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debuginfo-8.4.0-22.oe2403sp2.x86_64.rpm",
          "curl-debugsource-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-8.4.0-22.oe2403sp2.x86_64.rpm",
          "libcurl-devel-8.4.0-22.oe2403sp2.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP2",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-24.03-LTS-SP2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.4.0-22.oe2403sp2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "curl-7.71.1-43.oe2003sp4.aarch64.rpm",
          "curl-debuginfo-7.71.1-43.oe2003sp4.aarch64.rpm",
          "curl-debugsource-7.71.1-43.oe2003sp4.aarch64.rpm",
          "libcurl-7.71.1-43.oe2003sp4.aarch64.rpm",
          "libcurl-devel-7.71.1-43.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "curl-help-7.71.1-43.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "curl-7.71.1-43.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "curl-7.71.1-43.oe2003sp4.x86_64.rpm",
          "curl-debuginfo-7.71.1-43.oe2003sp4.x86_64.rpm",
          "curl-debugsource-7.71.1-43.oe2003sp4.x86_64.rpm",
          "libcurl-7.71.1-43.oe2003sp4.x86_64.rpm",
          "libcurl-devel-7.71.1-43.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "curl",
        "purl": "pkg:rpm/openEuler/curl\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.71.1-43.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\ncurl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path=\u0026quot;/\u0026quot;, a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)",
  "id": "OESA-2025-2319",
  "modified": "2026-08-06T11:09:23Z",
  "published": "2025-09-19T11:09:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2319"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9086"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "curl security update",
  "upstream": [
    "CVE-2025-9086"
  ]
}

CVE-2025-9086 (GCVE-0-2025-9086)

Vulnerability from cvelistv5 – Published: 2025-09-12 05:10 – Updated: 2026-09-15 06:02

Title

Out of bounds read for cookie path

Summary

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-09-12 17:15 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

curl redhat root

References

7 references

URL	Tags
https://curl.se/docs/CVE-2025-9086.json
https://curl.se/docs/CVE-2025-9086.html
https://hackerone.com/reports/3294999
http://www.openwall.com/lists/oss-security/2025/09/10/1
https://lists.debian.org/debian-lts-announce/2026…
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…

Impacted products

20 products

Vendor	Product	Version
curl	curl	Affected: 8.13.0 , < 8.14.2 (semver) Affected: 8.15.0 , < 8.16.0 (semver)
curl	curl	Affected: 1aea05a6c2699e80c75936d58569851555acd603 , < c6ae07c6a541e0e96d0040afb62b45dd37711300 (git)
curl	curl	Affected: 8.15.0 Affected: 8.14.1 Affected: 8.14.0 Affected: 8.13.0
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V3.3 (custom)
Siemens	RUGGEDCOM RST2428P	Affected: 0 , < V4.0 (custom)
Siemens	SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCH328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM324	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM328	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XCM332	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRH334 (24 V DC, 8xFO, CC)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24 V DC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 12xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230 V AC, 8xFO)	Affected: 0 , < V3.3 (custom)
Siemens	SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)	Affected: 0 , < V3.3 (custom)

Credits

Google Big Sleep Daniel Stenberg

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-9086",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T17:15:47.921625Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-12T17:16:20.317Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-01-05T02:47:38.406Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "RUGGEDCOM RST2428P",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V4.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCH328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM324",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM328",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XCM332",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24 V DC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "V3.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T12:59:46.514Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "8.14.2",
              "status": "affected",
              "version": "8.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.16.0",
              "status": "affected",
              "version": "8.15.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "repo": "https://github.com/curl/curl.git",
          "vendor": "curl",
          "versions": [
            {
              "lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300",
              "status": "affected",
              "version": "1aea05a6c2699e80c75936d58569851555acd603",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "curl",
          "vendor": "curl",
          "versions": [
            {
              "status": "affected",
              "version": "8.15.0"
            },
            {
              "status": "affected",
              "version": "8.14.1"
            },
            {
              "status": "affected",
              "version": "8.14.0"
            },
            {
              "status": "affected",
              "version": "8.13.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Google Big Sleep"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Daniel Stenberg"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T06:02:35.281Z",
        "orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
        "shortName": "curl"
      },
      "references": [
        {
          "url": "https://curl.se/docs/CVE-2025-9086.json"
        },
        {
          "url": "https://curl.se/docs/CVE-2025-9086.html"
        },
        {
          "url": "https://hackerone.com/reports/3294999"
        }
      ],
      "title": "Out of bounds read for cookie path",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_osv": {
        "affected": [
          {
            "ranges": [
              {
                "events": [
                  {
                    "introduced": "8.13.0"
                  },
                  {
                    "fixed": "8.14.2"
                  },
                  {
                    "introduced": "8.15.0"
                  },
                  {
                    "fixed": "8.16.0"
                  }
                ],
                "type": "SEMVER"
              },
              {
                "events": [
                  {
                    "introduced": "1aea05a6c2699e80c75936d58569851555acd603"
                  },
                  {
                    "fixed": "c6ae07c6a541e0e96d0040afb62b45dd37711300"
                  }
                ],
                "repo": "https://github.com/curl/curl.git",
                "type": "GIT"
              }
            ],
            "versions": [
              "8.15.0",
              "8.14.1",
              "8.14.0",
              "8.13.0"
            ]
          }
        ],
        "aliases": [
          "CVE-2025-9086"
        ],
        "credits": [
          {
            "name": "Google Big Sleep",
            "type": "finder"
          },
          {
            "name": "Daniel Stenberg",
            "type": "remediation developer"
          }
        ],
        "database_specific": {
          "CWE": {
            "desc": "Out-of-bounds Read",
            "id": "CWE-125"
          },
          "URL": "https://curl.se/docs/CVE-2025-9086.json",
          "affects": "lib",
          "award": {
            "amount": "505",
            "currency": "USD"
          },
          "issue": "https://hackerone.com/reports/3294999",
          "last_affected": "8.15.0",
          "package": "curl",
          "severity": "Low",
          "www": "https://curl.se/docs/CVE-2025-9086.html"
        },
        "details": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.",
        "id": "CURL-CVE-2025-9086",
        "modified": "2026-09-07T10:34:51.00Z",
        "published": "2025-09-10T08:00:00.00Z",
        "schema_version": "1.5.0",
        "summary": "Out of bounds read for cookie path"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
    "assignerShortName": "curl",
    "cveId": "CVE-2025-9086",
    "datePublished": "2025-09-12T05:10:03.815Z",
    "dateReserved": "2025-08-16T05:40:23.800Z",
    "dateUpdated": "2026-09-15T06:02:35.281Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.