CVE-2025-9086

1. A cookie is set using the secure keyword for https://target
2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with only a slash as path (path="/"). Since this site is not secure, the cookie should be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer boundary

The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.

The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (path="/"). Since this site is not secure, the cookie should be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

1. A cookie is set using the secure keyword for https://target
2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (path=\"/\",). Since this site is not secure, the cookie should just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer boundary

The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.

The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.

Security Fix(es):

curl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path="/", a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (path="/"). Since this site is not secure, the cookie should be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

• curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2025-9086: cookie: don't treat the leading slash as trailing

• CVE-2025-9086: cookie: don't treat the leading slash as trailing

• CVE-2025-9086: cookie: don't treat the leading slash as trailing

• CVE-2025-9086: cookie: don't treat the leading slash as trailing

1. A cookie is set using the secure keyword for https://target
2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with only a slash as path (path="/"). Since this site is not secure, the cookie should be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer boundary

The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.

The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

curl is susceptible to an out-of-bounds read in the cookie handler that could either cause a crash or potentially make allow a clear-text site to override the contents of a secure cookie. This release also fixes a rare memory leak in HTTP trailers.

These are all security issues fixed in the curl-8.16.0-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

• CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
• CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)
• CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

Other fixes:

• tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)

Root has patched CVE-2025-9086 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.

Root has patched CVE-2025-9086 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.

This update for curl fixes the following issues:

• CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
• CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

This update for curl fixes the following issues:

Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

Security issues fixed:

• CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
• CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
• CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not easily noticed (bsc#1243706).
• CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
• CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN backend (bsc#1228260).
• CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
• CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

• Fix wrong return code when --retry is used (bsc#1249367).

  • tool_operate: fix return code when --retry is used but not triggered [b42776b]

• Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

  • tool_getparam: fix --ftp-pasv [5f805ee]

• Fixed with version 8.14.1:

  • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
  • websocket: add option to disable auto-pong reply.
  • huge number of bugfixes.

  Please see https://curl.se/ch/ for full changelogs.

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
• CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

• Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

  • tool_getparam: fix --ftp-pasv [5f805ee]

• Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

  • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
  • websocket: add option to disable auto-pong reply.
  • huge number of bugfixes.

  Please see https://curl.se/ch/ for full changelogs.

This update for curl fixes the following issues:

Security issues fixed:

• CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
• CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

• Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

  • tool_getparam: fix --ftp-pasv [5f805ee]

• Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

  • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
  • websocket: add option to disable auto-pong reply.
  • huge number of bugfixes.

  Please see https://curl.se/ch/ for full changelogs.

This update for curl fixes the following issues:

• tool_operate: fix return code when --retry is used but not triggered [bsc#1249367]

• Security fixes:

  • CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
  • CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

This update for curl fixes the following issues:

• CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)

• CVE-2025-10148: Predictable WebSocket mask (bsc#1249348)

• Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]

• tool_operate: fix return code when --retry is used but not triggered [bsc#1249367]

• Updated to 8.14.1: [jsc#PED-13055, jsc#PED-13056]

  • Add _multibuild
  • Bugfixes:
    • asyn-thrdd: fix cleanup when RR fails due to OOM
    • ftp: fix teardown of DATA connection in done
    • http: fail early when rewind of input failed when following redirects
    • multi: fix add_handle resizing
    • tls BIOs: handle BIO_CTRL_EOF correctly
    • tool_getparam: make --no-anyauth not be accepted
    • wolfssl: fix sending of early data
    • ws: handle blocked sends better
    • ws: tests and fixes

• Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]

  • Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error when building the curl-mini package in SLE.
  • Add libssh minimum version requirements.
  • Use ldconfig_scriptlets when available.
  • Remove unused option --disable-ntlm-wb.

• Update to 8.14.0:

  • Changes:

    • mqtt: send ping at upkeep interval
    • schannel: handle pkcs12 client certificates containing CA certificates
    • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs
    • vquic: ngtcp2 + openssl support
    • wcurl: import v2025.04.20 script + docs
    • websocket: add option to disable auto-pong reply

  • Bugfixes:

    • asny-thrdd: fix detach from running thread
    • async-threaded resolver: use ref counter
    • async: DoH improvements
    • build: enable gcc-12/13+, clang-10+ picky warnings
    • build: enable gcc-15 picky warnings
    • certs: drop unused default_bits from .prm files
    • cf-https-connect: use the passed in dns struct pointer
    • cf-socket: fix FTP accept connect
    • cfilters: remove assert
    • cmake: fix nghttp3 static linking with USE_OPENSSL_QUIC=ON
    • cmake: prefer COMPILE_OPTIONS over CMAKE_C_FLAGS for custom C options
    • cmake: revert CURL_LTO behavior for multi-config generators
    • configure: fix --disable-rt
    • CONTRIBUTE: add project guidelines for AI use
    • cpool/cshutdown: force close connections under pressure
    • curl: fix memory leak when -h is used in config file
    • curl_get_line: handle lines ending on the buffer boundary
    • headers: enforce a max number of response header to accept
    • http: fix HTTP/2 handling of TE request header using "trailers"
    • lib: include files using known path
    • lib: unify conversions to/from hex
    • libssh: add NULL check for Curl_meta_get()
    • libssh: fix memory leak
    • mqtt: use conn/easy meta hash
    • multi: do transfer book keeping using mid
    • multi: init_do(): check result
    • netrc: avoid NULL deref on weird input
    • netrc: avoid strdup NULL
    • netrc: deal with null token better
    • openssl-quic: avoid potential -Wnull-dereference, add assert
    • openssl-quic: fix shutdown when stream not open
    • openssl: enable builds for both engines and providers
    • openssl: set the cipher string before doing private cert
    • progress: avoid integer overflow when gathering total transfer size
    • rand: update comment on Curl_rand_bytes weak random
    • rustls: make max size of cert and key reasonable
    • smb: avoid integer overflow on weird input date
    • urlapi: redirecting to "" is considered fine

• Update to 8.13.0:

  • Changes:
    • curl: add write-out variable 'tls_earlydata'
    • curl: make --url support a file with URLs
    • gnutls: set priority via --ciphers
    • IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags
    • lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY
    • OpenSSL/quictls: add support for TLSv1.3 early data
    • rustls: add support for CERTINFO
    • rustls: add support for SSLKEYLOGFILE
    • rustls: support ECH w/ DoH lookup for config …

This update for curl fixes the following issues:

• CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
• CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)
• CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

Other fixes:

• tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)

This update for curl fixes the following issues:

• CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
• CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)
• CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

Other fixes:

• tool_operate: fix return code when --retry is used but not triggered (bsc#1249367)

It was discovered that curl incorrectly handled cookies when redirected from secure to insecure connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)

Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)

Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)

Stanislav Fort discovered that curl did not properly validate pinned public keys under certain circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack. This issue only affected Ubuntu 25.10.(CVE-2025-13034)

Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS transfers in multi-threaded environments. Under certain circumstances, certificate verification could be unintentionally and unknowingly disabled. (CVE-2025-14017)

It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote attacker could possibly use this issue to obtain authentication credentials. (CVE-2025-14524)

Stanislav Fort discovered that curl did not properly validate TLS certificates when reusing connections. A remote attacker could possibly use this issue to bypass expected certificate verification. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)

Harry Sintonen discovered that curl did not properly validate SSH host keys when performing SSH-based file transfers. This issue could lead to unintended bypass of custom known_hosts file. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)

Harry Sintonen discovered that curl built with libssh did not properly handle authentication when performing SSH-based file transfers. This could result in unintended authentication operations. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)