cURL up to 8.15.0 Cookie Path out-of-bounds

Summaryinfo

A vulnerability described as critical has been identified in cURL up to 8.15.0. Affected is an unknown function of the component Cookie Path Handler. Executing a manipulation can lead to out-of-bounds. This vulnerability appears as CVE-2025-9086. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in cURL up to 8.15.0 and classified as critical. This vulnerability affects an unknown code block of the component Cookie Path Handler. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

The advisory is shared for download at curl.se. This vulnerability was named CVE-2025-9086. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 264615 (SUSE SLES12 Security Update : curl (SUSE-SU-2025:03173-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 8.16.0 eliminates this vulnerability. The upgrade is hosted for download at curl.se. Applying the patch f24dc09d209a2f91ca38d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (264615), EUVD (EUVD-2025-29014) and CERT Bund (WID-SEC-2025-2023). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• IBM AIX
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Dell Avamar
• NetApp Data ONTAP
• Open Source cURL
• NetApp ActiveIQ Unified Manager
• Dell NetWorker
• Dell Secure Connect Gateway
• Meinberg LANTIME
• HCL BigFix
• Tenable Security Nessus Network Monitor

Productinfo

Type

• Network Utility Software

Name

• cURL

Version

• 8.0
• 8.1
• 8.2
• 8.3
• 8.4
• 8.5
• 8.6
• 8.7
• 8.8
• 8.9
• 8.10
• 8.11
• 8.12
• 8.13
• 8.14
• 8.15.0

License

• open-source

Website

• Product: https://github.com/curl/curl/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion