{"id":"CVE-2025-9086","title":"1","summary":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name i…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-125"],"vendor":"haxx","product":"curl","affected":["curl >= 8.13.0, < 8.16.0","debian_linux = 11.0"],"patched":["curl 8.16.0"],"published":"2025-09-12","updated":"2026-09-14","sourceUpdated":"2026-09-14T21:16:59.523","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","references":[{"url":"https://curl.se/docs/CVE-2025-9086.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2025-9086.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3294999","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9086.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-9086"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394750"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9086"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086"},{"url":"https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6"},{"url":"https://access.redhat.com/errata/RHSA-2026:1825"},{"url":"https://access.redhat.com/errata/RHSA-2025:23043"},{"url":"https://access.redhat.com/errata/RHSA-2026:1350"},{"url":"https://access.redhat.com/errata/RHSA-2026:1477"},{"url":"https://access.redhat.com/errata/RHSA-2025:23383"},{"url":"https://access.redhat.com/errata/RHSA-2025:23126"},{"url":"https://access.redhat.com/errata/RHSA-2025:23127"},{"url":"https://access.redhat.com/errata/RHSA-2025:23125"},{"url":"https://access.redhat.com/errata/RHSA-2026:82354"},{"url":"https://access.redhat.com/errata/RHSA-2026:82372"},{"url":"https://access.redhat.com/errata/RHSA-2026:82347"},{"url":"https://access.redhat.com/errata/RHSA-2026:1736"},{"url":"https://access.redhat.com/errata/RHSA-2026:6893"},{"url":"https://access.redhat.com/errata/RHSA-2026:77255"},{"url":"https://access.redhat.com/errata/RHSA-2026:2485"},{"url":"https://access.redhat.com/errata/RHSA-2026:4943"},{"url":"https://access.redhat.com/errata/RHSA-2026:2563"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.01463,"epssPercentile":0.73487,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-09-12T17:15:47.921625Z"},"ingestedAt":"2026-09-14T21:15:17.560Z","scores":{"nvd":7.5,"vendor":5.3},"slug":"CVE-2025-9086","body":"## Overview\n\n1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.\n\n## Affected\n\n- `curl >= 8.13.0, < 8.16.0`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.16.0`\n\n## Vendor advisories\n\n- **RHSA-2026:1825** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:1825)\n- **RHSA-2025:23043** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · released 2025-12-10 · [advisory](https://access.redhat.com/errata/RHSA-2025:23043)\n- **RHSA-2026:1350** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-01-27 · [advisory](https://access.redhat.com/errata/RHSA-2026:1350)\n- **RHSA-2026:1477** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v. 10.0) · released 2026-01-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:1477)\n- **RHSA-2025:23383** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8) · released 2025-12-18 · [advisory](https://access.redhat.com/errata/RHSA-2025:23383)\n- **RHSA-2025:23126** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.9.0) · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23126)\n- **RHSA-2025:23127** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23127)\n- **RHSA-2025:23125** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS EUS (v.9.4) · released 2025-12-11 · [advisory](https://access.redhat.com/errata/RHSA-2025:23125)\n- **RHSA-2026:82354** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82354)\n- **RHSA-2026:82372** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82372)\n- **RHSA-2026:82347** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82347)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat Trusted Profile Analyzer · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat JBoss Core Services, Red Hat OpenShift Container Platform 4, … · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-9086.json)","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}