CVE-2025-9086 | THREATINT

Description

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

PUBLISHED Reserved 2025-08-16 | Published 2025-09-12 | Updated 2025-09-12 | Assigner curl

Problem types

CWE-125 Out-of-bounds Read

Product status

Default status

unaffected

8.15.0 (semver)

affected

8.14.1 (semver)

affected

8.14.0 (semver)

affected

8.13.0 (semver)

affected

8.12.1 (semver)

affected

8.12.0 (semver)

affected

8.11.1 (semver)

affected

8.11.0 (semver)

affected

8.10.1 (semver)

affected

8.10.0 (semver)

affected

8.9.1 (semver)

affected

8.9.0 (semver)

affected

8.8.0 (semver)

affected

8.7.1 (semver)

affected

8.7.0 (semver)

affected

8.6.0 (semver)

affected

8.5.0 (semver)

affected

8.4.0 (semver)

affected

8.3.0 (semver)

affected

8.2.1 (semver)

affected

8.2.0 (semver)

affected

8.1.2 (semver)

affected

8.1.1 (semver)

affected

8.1.0 (semver)

affected

8.0.1 (semver)

affected

8.0.0 (semver)

affected

7.88.1 (semver)

affected

7.88.0 (semver)

affected

7.87.0 (semver)

affected

7.86.0 (semver)

affected

7.85.0 (semver)

affected

7.84.0 (semver)

affected

7.83.1 (semver)

affected

7.83.0 (semver)

affected

7.82.0 (semver)

affected

7.81.0 (semver)

affected

7.80.0 (semver)

affected

7.79.1 (semver)

affected

7.79.0 (semver)

affected

7.78.0 (semver)

affected

7.77.0 (semver)

affected

7.76.1 (semver)

affected

7.76.0 (semver)

affected

7.75.0 (semver)

affected

7.74.0 (semver)

affected

7.73.0 (semver)

affected

7.72.0 (semver)

affected

7.71.1 (semver)

affected

7.71.0 (semver)

affected

7.70.0 (semver)

affected

7.69.1 (semver)

affected

7.69.0 (semver)

affected

7.68.0 (semver)

affected

7.67.0 (semver)

affected

7.66.0 (semver)

affected

7.65.3 (semver)

affected

7.65.2 (semver)

affected

7.65.1 (semver)

affected

7.65.0 (semver)

affected

7.64.1 (semver)

affected

7.64.0 (semver)

affected

7.63.0 (semver)

affected

7.62.0 (semver)

affected

7.61.1 (semver)

affected

7.61.0 (semver)

affected

7.60.0 (semver)

affected

7.59.0 (semver)

affected

7.58.0 (semver)

affected

7.57.0 (semver)

affected

7.56.1 (semver)

affected

7.56.0 (semver)

affected

7.55.1 (semver)

affected

7.55.0 (semver)

affected

7.54.1 (semver)

affected

7.54.0 (semver)

affected

7.53.1 (semver)

affected

7.53.0 (semver)

affected

7.52.1 (semver)

affected

7.52.0 (semver)

affected

7.51.0 (semver)

affected

7.50.3 (semver)

affected

7.50.2 (semver)

affected

7.50.1 (semver)

affected

7.50.0 (semver)

affected

7.49.1 (semver)

affected

7.49.0 (semver)

affected

7.48.0 (semver)

affected

7.47.1 (semver)

affected

7.47.0 (semver)

affected

7.46.0 (semver)

affected

7.45.0 (semver)

affected

7.44.0 (semver)

affected

7.43.0 (semver)

affected

7.42.1 (semver)

affected

7.42.0 (semver)

affected

7.41.0 (semver)

affected

7.40.0 (semver)

affected

7.39.0 (semver)

affected

7.38.0 (semver)

affected

7.37.1 (semver)

affected

7.37.0 (semver)

affected

7.36.0 (semver)

affected

7.35.0 (semver)

affected

7.34.0 (semver)

affected

7.33.0 (semver)

affected

7.32.0 (semver)

affected

7.31.0 (semver)

affected

Credits

Google Big Sleep finder

Daniel Stenberg remediation developer

References

curl.se/docs/CVE-2025-9086.json (json)

curl.se/docs/CVE-2025-9086.html (www)

hackerone.com/reports/3294999 (issue)

cve.org (CVE-2025-9086)

nvd.nist.gov (CVE-2025-9086)

Download JSON