{"id":"CVE-2025-9086","aliases":["ALPINE-CVE-2025-9086","ALSA-2025:23383","ALSA-2026:1350","ALSA-2026:1825","BELL-CVE-2025-9086","CLSA-2026-1767807099","CLSA-2026-1767808644","CLSA-2026-1769092364","CLSA-2026-1770370767","CURL-CVE-2025-9086","DEBIAN-CVE-2025-9086","DLA-4432-1","EUVD-2025-29014","GHSA-v676-f8gm-92r9","JLSEC-2026-435","MGASA-2025-0232","OESA-2025-2319","RHSA-2025:23043","RHSA-2025:23125","RHSA-2025:23126","RHSA-2025:23127","RHSA-2025:23383","RHSA-2026:1350","RHSA-2026:1477","RHSA-2026:1825","RHSA-2026:6893","RHSA-2026:77255","RHSA-2026:82895","RLSA-2025:23383","RLSA-2026:1350","RLSA-2026:1825","ROOT-OS-ALPINE-315-CVE-2025-9086","ROOT-OS-ALPINE-317-CVE-2025-9086","SUSE-SU-2025:03173-1","SUSE-SU-2025:03198-1","SUSE-SU-2025:03267-1","SUSE-SU-2025:03268-1","SUSE-SU-2025:20802-1","SUSE-SU-2025:20824-1","SUSE-SU-2025:21077-1","SUSE-SU-2025:21145-1","UBUNTU-CVE-2025-9086","USN-8062-1","openSUSE-SU-2025:15590-1","openSUSE-SU-2025:20090-1"],"status":"published","title":"Out of bounds read for cookie path","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01463,"percentile":0.73813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-09-10T07:00:00Z","modified":"2026-11-04T17:15:25Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"curl","fixed_in":["7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libcurl","fixed_in":["7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libcurl-devel","fixed_in":["7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libcurl-minimal","fixed_in":["7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"curl","fixed_in":["7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"curl-minimal","fixed_in":["7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libcurl","fixed_in":["7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libcurl-devel","fixed_in":["7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"libcurl-minimal","fixed_in":["7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"curl","fixed_in":["8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libcurl","fixed_in":["8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libcurl-devel","fixed_in":["8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"libcurl-minimal","fixed_in":["8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"curl","fixed_in":["8.9.1-r3"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"curl","fixed_in":["8.14.1-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"curl","fixed_in":["8.16.0-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"curl","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"curl","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","fixed_in":["7.61.1-22.el8.tuxcare.els15"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"curl","fixed_in":["7.61.1-34.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"curl-minimal","fixed_in":["7.61.1-34.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl","fixed_in":["7.61.1-34.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-devel","fixed_in":["7.61.1-34.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-minimal","fixed_in":["7.61.1-34.el8.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","fixed_in":["7.76.1-31.el9_6.1.tuxcare.els3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["8.14.1-2+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["8.16.0~rc2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"curl","fixed_in":["7.74.0-1.3+deb11u16"],"sources":["osv"]},{"ecosystem":"Julia","package":"CURL_jll","fixed_in":["8.16.0+0"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["8.16.0+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"curl","fixed_in":["7.88.1-4.8.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"curl","fixed_in":["7.79.1-42.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","fixed_in":["7.79.1-42.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"curl","fixed_in":["8.4.0-22.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","fixed_in":["8.4.0-22.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"curl","fixed_in":["8.4.0-22.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","fixed_in":["7.71.1-43.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"curl-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"curl-debugsource","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"curl-minimal-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libcurl-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libcurl-devel","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-debugsource","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-minimal","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-minimal-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl-minimal","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.76.1-31.el9_6.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"curl","fixed_in":["0:7.76.1-29.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"curl-minimal","fixed_in":["0:7.76.1-29.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libcurl","fixed_in":["0:7.76.1-29.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libcurl-minimal","fixed_in":["0:7.76.1-29.el9_4.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"curl","fixed_in":["0:7.76.1-14.el9_0.12"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"curl-minimal","fixed_in":["0:7.76.1-14.el9_0.12"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libcurl","fixed_in":["0:7.76.1-14.el9_0.12"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libcurl-minimal","fixed_in":["0:7.76.1-14.el9_0.12"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"curl","fixed_in":["0:7.76.1-23.el9_2.8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"curl-minimal","fixed_in":["0:7.76.1-23.el9_2.8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libcurl","fixed_in":["0:7.76.1-23.el9_2.8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libcurl-minimal","fixed_in":["0:7.76.1-23.el9_2.8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debugsource","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-minimal-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-devel","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debugsource","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl","fixed_in":["0:8.12.1-1.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl","fixed_in":["0:8.12.1-1.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal","fixed_in":["0:8.12.1-1.el10_0.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"curl-debuginfo","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"curl-debugsource","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-debuginfo","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-devel","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-minimal-debuginfo","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"curl","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-minimal","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"curl","fixed_in":["0:7.61.1-34.el8_10.9"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"curl","fixed_in":["0:7.76.1-35.el9_7.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"curl","fixed_in":["0:8.12.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.15","package":"rootio-curl","fixed_in":["8.5.0-r00073","8.5.0-r00074","8.5.0-r00075"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"curl","fixed_in":["8.9.0-r00073","8.9.0-r00074","8.9.0-r00075","8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Root:Alpine:3.17","package":"rootio-curl","fixed_in":["8.9.0-r00073","8.9.0-r00074","8.9.0-r00075","8.9.0-r00076","8.9.0-r00077"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"curl","fixed_in":["8.14.1-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.13.0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.0-r2"},{"fixed":"8.9.1-r3"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.14.0-r1"},{"fixed":"8.14.1-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.1.2-r0"},{"fixed":"8.16.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-22.el8.tuxcare.els15"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.61.1-34.el8.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.76.1-31.el9_6.1.tuxcare.els3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2+deb13u1"}]}],"versions":["8.14.1-2"]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.0~rc2-1"}]}],"versions":["8.14.1-2","8.14.1-2+exp1","8.15.0-1","8.15.0-1~bpo13+1","8.15.0-1~exp1","8.15.0~rc1-1exp1","8.15.0~rc2-1~exp1","8.15.0~rc3-1~exp1","8.16.0~rc1-1~exp1"]},{"source":"osv","ecosystem":"Debian:11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.74.0-1.3+deb11u16"}]}],"versions":["7.74.0-1.3","7.74.0-1.3+deb11u1","7.74.0-1.3+deb11u10","7.74.0-1.3+deb11u11","7.74.0-1.3+deb11u12","7.74.0-1.3+deb11u13","7.74.0-1.3+deb11u14","7.74.0-1.3+deb11u15","7.74.0-1.3+deb11u2","7.74.0-1.3+deb11u3","7.74.0-1.3+deb11u4","7.74.0-1.3+deb11u5","7.74.0-1.3+deb11u6","7.74.0-1.3+deb11u7","7.74.0-1.3+deb11u7~bpo11+1","7.74.0-1.3+deb11u8","7.74.0-1.3+deb11u9"]},{"source":"osv","ecosystem":"Julia","package":"CURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.13.0+0"},{"fixed":"8.16.0+0"}]}]},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"8.13.0+0"},{"fixed":"8.16.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.88.1-4.8.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-42.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.79.1-42.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-22.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-22.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.0-22.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.1-43.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-31.el9_6.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-29.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-29.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-29.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-29.el9_4.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.12"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.12"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.12"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-14.el9_0.12"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-23.el9_2.8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-23.el9_2.8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-23.el9_2.8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-23.el9_2.8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-1.el10_0.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.19.0-3.hum1"}]}],"bundled":13},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.22.0-1.1.hum1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.23.0-0.1.hum1"}]}],"bundled":26},{"source":"osv","ecosystem":"Rocky Linux:8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-34.el8_10.9"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.76.1-35.el9_7.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.12.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.15","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-r00073"},{"fixed":"8.5.0-r00074"},{"fixed":"8.5.0-r00075"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00073"},{"fixed":"8.9.0-r00074"},{"fixed":"8.9.0-r00075"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"Root:Alpine:3.17","package":"rootio-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.9.0-r00073"},{"fixed":"8.9.0-r00074"},{"fixed":"8.9.0-r00075"},{"fixed":"8.9.0-r00076"},{"fixed":"8.9.0-r00077"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.108.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.1-11.108.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150600.4.28.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Installer Updates 15 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150400.5.69.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy LTS 4.3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server LTS 4.3","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-150200.4.91.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"brotli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150200.3.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.1"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.81.0-1ubuntu1.22"}]}],"versions":["7.74.0-1.3ubuntu2","7.74.0-1.3ubuntu3","7.80.0-3","7.81.0-1","7.81.0-1ubuntu1.1","7.81.0-1ubuntu1.2","7.81.0-1ubuntu1.3","7.81.0-1ubuntu1.4","7.81.0-1ubuntu1.6","7.81.0-1ubuntu1.7","7.81.0-1ubuntu1.8","7.81.0-1ubuntu1.10","7.81.0-1ubuntu1.11","7.81.0-1ubuntu1.13","7.81.0-1ubuntu1.14","7.81.0-1ubuntu1.15","7.81.0-1ubuntu1.16","7.81.0-1ubuntu1.17","7.81.0-1ubuntu1.18","7.81.0-1ubuntu1.19","7.81.0-1ubuntu1.20","7.81.0-1ubuntu1.21"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.0-2ubuntu10.7"}]}],"versions":["8.2.1-1ubuntu3","8.2.1-1ubuntu3.1","8.4.0-2ubuntu1","8.5.0-2ubuntu1","8.5.0-2ubuntu2","8.5.0-2ubuntu8","8.5.0-2ubuntu9","8.5.0-2ubuntu10","8.5.0-2ubuntu10.1","8.5.0-2ubuntu10.2","8.5.0-2ubuntu10.3","8.5.0-2ubuntu10.4","8.5.0-2ubuntu10.5","8.5.0-2ubuntu10.6"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-2ubuntu1.1"}]}],"versions":["8.12.1-3ubuntu1","8.13.0-5ubuntu1","8.14.1-1ubuntu2","8.14.1-1ubuntu3","8.14.1-2ubuntu1"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.14.1-160000.3.1"}]}],"bundled":3}],"products":[{"vendor":"curl","product":"curl"},{"vendor":"debian","product":"debian_linux"},{"vendor":"haxx","product":"curl"},{"vendor":"siemens","product":"ruggedcom rst2428p"},{"vendor":"siemens","product":"scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family"},{"vendor":"siemens","product":"scalance xch328"},{"vendor":"siemens","product":"scalance xcm324"},{"vendor":"siemens","product":"scalance xcm328"},{"vendor":"siemens","product":"scalance xcm332"},{"vendor":"siemens","product":"scalance xrh334 (24 v dc, 8xfo, cc)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (230v ac, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24 v dc, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (24v dc, 2x10g, 24xsfp, 8xsfp+)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 12xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230 v ac, 8xfo)"},{"vendor":"siemens","product":"scalance xrm334 (2x230v ac, 2x10g, 24xsfp, 8xsfp+)"}],"references":[{"url":"https://curl.se/docs/CVE-2025-9086.json","tags":["Vendor Advisory","web","article"]},{"url":"https://curl.se/docs/CVE-2025-9086.html","tags":["Patch","Vendor Advisory","web","advisory","article","report"]},{"url":"https://hackerone.com/reports/3294999","tags":["Exploit","Issue Tracking","Third Party Advisory","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/1","tags":["Mailing List","Patch","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-v676-f8gm-92r9","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-9086","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23383","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9086","tags":["report"]},{"url":"https://bugzilla.redhat.com/2394750","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-23383.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1350","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-1350.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1825","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-1825.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-9086","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1767807099.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1767808644.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1769092364.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1770370767.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9086.json","tags":["advisory"]},{"url":"https://github.com/curl/curl.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-9086","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2025-0232.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34623","tags":["report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2319","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23043","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394750","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23043.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-9086","tags":["advisory","report"]},{"url":"https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23125","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23125.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23126","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23126.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:23127","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23127.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_23383.json","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-129493","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1350.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:1477","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1477.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1825.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6893","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10148","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10966","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15224","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-15079","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14819","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14524","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-13034","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3805","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3783","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-3784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1965","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-14017","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6893.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394749","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10148","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-10148.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10148.json","tags":["article"]},{"url":"https://hackerone.com/reports/3330839","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2413308","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10966","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10966","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2025/11/05/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10966.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-10966.json","tags":["article"]},{"url":"https://github.com/curl/curl/commit/b011e3fcfb06d6c027859","tags":["article"]},{"url":"https://hackerone.com/reports/3355218","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426406","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13034","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13034","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427870","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14017","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14017.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2025-14017.json","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426407","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14524","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14524","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426408","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14819","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2025-14819.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426409","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15079","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15079","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2426410","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-15224","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15224","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446448","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1965","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1965","tags":["advisory"]},{"url":"https://curl.se/docs/CVE-2026-1965.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-1965.json","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446450","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3783","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/2","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3783.json","tags":["article"]},{"url":"https://hackerone.com/reports/3583983","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446449","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3784","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3784","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/3","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3784.json","tags":["article"]},{"url":"https://hackerone.com/reports/3584903","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2446451","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-3805","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3805","tags":["advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/11/4","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3805.html","tags":["article"]},{"url":"https://curl.se/docs/CVE-2026-3805.json","tags":["article"]},{"url":"https://hackerone.com/reports/3591944","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:77255","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77255.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82895","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92392","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92388","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86414","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86410","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92389","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94265","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87866","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-94266","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-107929","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92386","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92391","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92390","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86413","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-92387","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87865","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87863","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87864","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87862","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-87861","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86409","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86411","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-86412","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82895.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550378","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86409","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86410","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550364","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86411","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550374","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86412","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550594","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86413","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550343","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86414","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550611","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87862","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550645","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87863","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550666","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87864","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550675","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-87866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550682","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92386","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550691","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92387","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550692","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92388","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550700","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92389","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92390","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92391","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2548642","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-92392","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550717","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-94266","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550720","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2550721","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2025:23383","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1350","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:1825","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503173-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1249191","tags":["report"]},{"url":"https://bugzilla.suse.com/1249348","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-9086","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503198-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1228260","tags":["report"]},{"url":"https://bugzilla.suse.com/1236589","tags":["report"]},{"url":"https://bugzilla.suse.com/1243397","tags":["report"]},{"url":"https://bugzilla.suse.com/1243706","tags":["report"]},{"url":"https://bugzilla.suse.com/1243933","tags":["report"]},{"url":"https://bugzilla.suse.com/1246197","tags":["report"]},{"url":"https://bugzilla.suse.com/1249367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5025","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5399","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503267-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503268-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520802-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520824-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521077-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253757","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-11563","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521145-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-9086","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8062-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-10148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-11563","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13034","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14017","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14524","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-14819","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15079","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-15224","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-9086","title":"Out of bounds read for cookie path","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-12T05:10:03.815Z","modified":"2026-09-15T06:02:35.281Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:33.755525Z"}],"euvd":[{"id":"EUVD-2025-29014","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-12T05:10:03Z","modified":"2026-09-15T06:02:35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:19.01786Z"}],"ghsa":[{"id":"GHSA-v676-f8gm-92r9","title":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or...","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with just a slash as path (`path='/'`).\n   Since this site is not secure, the cookie *should* just be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-12T06:30:26Z","modified":"2026-06-02T15:32:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:08:29.586291Z"}],"nvd":[{"id":"CVE-2025-9086","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-12T06:15:44.1Z","modified":"2026-10-19T17:10:00.173Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:11:28.834562Z"}],"osv":[{"id":"ALPINE-CVE-2025-9086","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-12T06:15:44.1Z","modified":"2026-09-15T08:30:51.080123104Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"BELL-CVE-2025-9086","status":"published","published":"2025-09-11T11:34:56.849963Z","modified":"2026-01-26T09:41:05.028523Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2025-9086","title":"Out of bounds read for cookie path","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-12T05:10:03.815Z","modified":"2026-10-28T11:06:40.136737414Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:53.185592Z"},{"id":"DEBIAN-CVE-2025-9086","description":"1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same    hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).    Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer    boundary  The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.  The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.","status":"published","published":"2025-09-12T06:15:44.1Z","modified":"2026-10-23T17:47:43.482687414Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:48.440897Z"},{"id":"JLSEC-2026-435","title":"1","description":"1. A cookie is set using the `secure` keyword for `https://target`\n 2. curl is redirected to or otherwise made to speak with `http://target` (same\n    hostname, but using clear text HTTP) using the same cookie set\n 3. The same cookie name is set - but with just a slash as path (`path=\\\"/\\\",`).\n    Since this site is not secure, the cookie *should* just be ignored.\n 4. A bug in the path comparison logic makes curl read outside a heap buffer\n    boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2026-05-04T13:12:06.605Z","modified":"2026-07-25T18:24:26.027100266Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2025-2319","title":"curl security update","description":"cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols.\r\n\r\nSecurity Fix(es):\n\ncurl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path=\u0026quot;/\u0026quot;, a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)","status":"published","published":"2025-09-19T11:09:23Z","modified":"2026-08-18T01:19:11.118284871Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:23043","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2025-12-11T10:06:44Z","modified":"2026-10-16T10:08:06Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:23125","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2025-12-12T10:07:47Z","modified":"2026-10-16T10:08:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:23126","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2025-12-12T10:07:48Z","modified":"2026-10-16T10:08:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:23127","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2025-12-12T10:07:48Z","modified":"2026-10-16T10:08:09Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:23383","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2025-12-19T10:09:39Z","modified":"2026-10-16T10:08:14Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2026:1350","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-01-28T10:13:27Z","modified":"2026-10-16T10:10:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:18.066978Z"},{"id":"RHSA-2026:1477","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-01-29T10:20:57Z","modified":"2026-10-16T10:11:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:1825","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2026-02-04T10:19:05Z","modified":"2026-10-16T10:12:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:18.520917Z"},{"id":"RHSA-2026:6893","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-20T10:10:50Z","modified":"2026-10-16T10:23:46Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:77255","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-14T10:31:04Z","modified":"2026-10-16T10:26:01Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:82895","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-10-15T10:28:47Z","modified":"2026-10-18T10:05:11Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2025:23383","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2025-12-19T09:02:54.260652Z","modified":"2025-12-19T09:45:05.676323Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.216873Z"},{"id":"RLSA-2026:1350","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-01-30T22:09:16.253957Z","modified":"2026-01-30T22:29:59.372138Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"RLSA-2026:1825","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.\n\nSecurity Fix(es):\n\n* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-02-06T09:08:48.331063Z","modified":"2026-02-06T09:30:07.549491Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:25.508922Z"},{"id":"UBUNTU-CVE-2025-9086","description":"1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same    hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).    Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer    boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.","status":"published","published":"2025-09-10T07:00:00Z","modified":"2026-10-28T20:16:38.075528545Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:55.926217Z"},{"id":"ALSA-2025:23383","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-12-16T00:00:00Z","modified":"2026-10-29T11:02:22.882909439Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"ALSA-2026:1350","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-01-27T00:00:00Z","modified":"2026-10-29T11:32:30.676737066Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"ALSA-2026:1825","title":"Moderate: curl security update","description":"The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.  \n\nSecurity Fix(es):  \n\n  * curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-02-03T00:00:00Z","modified":"2026-10-29T11:58:14.124475Z","updated_at":"2026-11-02T15:27:53.875139Z"},{"id":"CLSA-2026-1767807099","title":"curl: Fix of CVE-2025-9086","description":"- CVE-2025-9086: cookie: don't treat the leading slash as trailing","status":"published","published":"2026-01-07T17:31:43Z","modified":"2026-06-01T00:33:23.227696106Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1767808644","title":"curl: Fix of CVE-2025-9086","description":"- CVE-2025-9086: cookie: don't treat the leading slash as trailing","status":"published","published":"2026-01-07T17:57:28Z","modified":"2026-06-01T00:32:26.697951862Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1769092364","title":"curl: Fix of CVE-2025-9086","description":"- CVE-2025-9086: cookie: don't treat the leading slash as trailing","status":"published","published":"2026-01-22T14:32:48Z","modified":"2026-06-01T00:33:01.193401652Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1770370767","title":"curl: Fix of CVE-2025-9086","description":"- CVE-2025-9086: cookie: don't treat the leading slash as trailing","status":"published","published":"2026-02-06T09:39:31Z","modified":"2026-06-01T00:32:40.487545226Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CURL-CVE-2025-9086","title":"Out of bounds read for cookie path","description":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.","status":"published","published":"2025-09-10T08:00:00Z","modified":"2026-10-25T01:04:34.038285528Z","updated_at":"2026-11-02T15:43:55.998148Z"},{"id":"DLA-4432-1","title":"curl - security update","status":"published","published":"2026-01-04T00:00:00Z","modified":"2026-01-05T01:14:54.846079Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0232","title":"Updated curl packages fix security vulnerability","description":"curl is susceptible to an out-of-bounds read in the cookie handler that\ncould either cause a crash or potentially make allow a clear-text site\nto override the contents of a secure cookie. This release also fixes a\nrare memory leak in HTTP trailers.\n","status":"published","published":"2025-09-11T17:02:41Z","modified":"2026-04-16T04:42:17.838821984Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15590-1","title":"curl-8.16.0-1.1 on GA media","description":"These are all security issues fixed in the curl-8.16.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-01T00:00:00Z","modified":"2026-03-23T04:53:58.730295Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20090-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)\n- CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n\nOther fixes:\n- tool_operate: fix return code when --retry is used but not\n  triggered (bsc#1249367)\n","status":"published","published":"2025-11-26T14:30:14Z","modified":"2026-03-23T04:54:16.757459Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"ROOT-OS-ALPINE-315-CVE-2025-9086","title":"CVE-2025-9086 in curl - Patched by Root","description":"Root has patched CVE-2025-9086 in the curl package for Root:Alpine:3.15. Multiple fixed versions available.","status":"published","published":"2026-11-04T10:54:49Z","modified":"2026-11-04T11:15:05.541334338Z","updated_at":"2026-11-04T11:38:21.953745Z"},{"id":"ROOT-OS-ALPINE-317-CVE-2025-9086","title":"CVE-2025-9086 in curl - Patched by Root","description":"Root has patched CVE-2025-9086 in the curl package for Root:Alpine:3.17. Multiple fixed versions available.","status":"published","published":"2026-11-04T16:15:55Z","modified":"2026-11-04T17:15:25.072980008Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"SUSE-SU-2025:03173-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n","status":"published","published":"2025-09-11T12:55:00Z","modified":"2026-03-23T04:48:00.128721Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03198-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nUpdate to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).    \n    \nSecurity issues fixed:\n\n- CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).\n- CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).\n- CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not\n  easily noticed (bsc#1243706).\n- CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing\n  specially crafted packets (bsc#1243933).\n- CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN\n  backend (bsc#1228260).\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n\nOther issues fixed:\n    \n- Fix wrong return code when --retry is used (bsc#1249367).\n  * tool_operate: fix return code when --retry is used but not triggered [b42776b]\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Fixed with version 8.14.1:\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-12T12:15:10Z","modified":"2026-03-23T04:50:28.709496Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03267-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n    \nOther issues fixed:\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n","status":"published","published":"2025-09-18T11:06:28Z","modified":"2026-02-04T03:59:16.877302Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03268-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer\n  (bsc#1249191).\n- CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).\n    \nOther issues fixed:\n    \n- Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).\n  * tool_getparam: fix --ftp-pasv [5f805ee]\n\n- Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).\n  * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.\n  * websocket: add option to disable auto-pong reply.\n  * huge number of bugfixes.\n\n  Please see https://curl.se/ch/ for full changelogs.\n\n","status":"published","published":"2025-09-18T11:08:43Z","modified":"2026-02-04T03:08:47.033591Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20802-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- tool_operate: fix return code when --retry is used but not\n  triggered [bsc#1249367]\n\n- Security fixes:\n  \n  * CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n  * CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n","status":"published","published":"2025-09-26T09:20:48Z","modified":"2026-03-23T04:49:04.774409Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20824-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-10148: Predictable WebSocket mask (bsc#1249348)\n- Fix the --ftp-pasv option in curl v8.14.1 [bsc#1246197]\n- tool_operate: fix return code when --retry is used but not\n  triggered [bsc#1249367]\n\n- Updated to 8.14.1: [jsc#PED-13055, jsc#PED-13056]\n  * Add _multibuild\n  * Bugfixes:\n    - asyn-thrdd: fix cleanup when RR fails due to OOM\n    - ftp: fix teardown of DATA connection in done\n    - http: fail early when rewind of input failed when following redirects\n    - multi: fix add_handle resizing\n    - tls BIOs: handle BIO_CTRL_EOF correctly\n    - tool_getparam: make --no-anyauth not be accepted\n    - wolfssl: fix sending of early data\n    - ws: handle blocked sends better\n    - ws: tests and fixes\n\n- Sync spec file with SLE codestreams: [jsc#PED-13055, jsc#PED-13056]\n  \n  * Add curl-mini.rpmlintrc to avoid rpmlint shlib-policy-name-error\n    when building the curl-mini package in SLE.\n  * Add libssh minimum version requirements.\n  * Use ldconfig_scriptlets when available.\n  * Remove unused option --disable-ntlm-wb.\n\n- Update to 8.14.0:\n  \n  * Changes:\n    - mqtt: send ping at upkeep interval\n    - schannel: handle pkcs12 client certificates containing CA certificates\n    - TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs\n    - vquic: ngtcp2 + openssl support\n    - wcurl: import v2025.04.20 script + docs\n    - websocket: add option to disable auto-pong reply\n  \n  * Bugfixes:\n    - asny-thrdd: fix detach from running thread\n    - async-threaded resolver: use ref counter\n    - async: DoH improvements\n    - build: enable gcc-12/13+, clang-10+ picky warnings\n    - build: enable gcc-15 picky warnings\n    - certs: drop unused `default_bits` from `.prm` files\n    - cf-https-connect: use the passed in dns struct pointer\n    - cf-socket: fix FTP accept connect\n    - cfilters: remove assert\n    - cmake: fix nghttp3 static linking with `USE_OPENSSL_QUIC=ON`\n    - cmake: prefer `COMPILE_OPTIONS` over `CMAKE_C_FLAGS` for custom C options\n    - cmake: revert `CURL_LTO` behavior for multi-config generators\n    - configure: fix --disable-rt\n    - CONTRIBUTE: add project guidelines for AI use\n    - cpool/cshutdown: force close connections under pressure\n    - curl: fix memory leak when -h is used in config file\n    - curl_get_line: handle lines ending on the buffer boundary\n    - headers: enforce a max number of response header to accept\n    - http: fix HTTP/2 handling of TE request header using \"trailers\"\n    - lib: include files using known path\n    - lib: unify conversions to/from hex\n    - libssh: add NULL check for Curl_meta_get()\n    - libssh: fix memory leak\n    - mqtt: use conn/easy meta hash\n    - multi: do transfer book keeping using mid\n    - multi: init_do(): check result\n    - netrc: avoid NULL deref on weird input\n    - netrc: avoid strdup NULL\n    - netrc: deal with null token better\n    - openssl-quic: avoid potential `-Wnull-dereference`, add assert\n    - openssl-quic: fix shutdown when stream not open\n    - openssl: enable builds for *both* engines and providers\n    - openssl: set the cipher string before doing private cert\n    - progress: avoid integer overflow when gathering total transfer size\n    - rand: update comment on Curl_rand_bytes weak random\n    - rustls: make max size of cert and key reasonable\n    - smb: avoid integer overflow on weird input date\n    - urlapi: redirecting to \"\" is considered fine\n\n- Update to 8.13.0:\n  \n  * Changes:\n    - curl: add write-out variable 'tls_earlydata'\n    - curl: make --url support a file with URLs\n    - gnutls: set priority via --ciphers\n    - IMAP: add CURLOPT_UPLOAD_FLAGS and --upload-flags\n    - lib: add CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY\n    - OpenSSL/quictls: add support for TLSv1.3 early data\n    - rustls: add support for CERTINFO\n    - rustls: add support for SSLKEYLOGFILE\n    - rustls: support ECH w/ DoH lookup for config\n    - rustls: support native platform verifier\n    - var: add a '64dec' function that can base64 decode a string\n  \n  * Bugfixes:\n    - conn: fix connection reuse when SSL is optional\n    - hash: use single linked list for entries\n    - http2: detect session being closed on ingress handling\n    - http2: reset stream on response header error\n    - http: remove a HTTP method size restriction\n    - http: version negotiation\n    - httpsrr: fix port detection\n    - libssh: fix freeing of resources in disconnect\n    - libssh: fix scp large file upload for 32-bit size_t systems\n    - openssl-quic: do not iterate over multi handles\n    - openssl: check return value of X509_get0_pubkey\n    - openssl: drop support for old OpenSSL/LibreSSL versions\n    - openssl: fix crash on missing cert password\n    - openssl: fix pkcs11 URI checking for key files.\n    - openssl: remove bad `goto`s into other scope\n    - setopt: illegal CURLOPT_SOCKS5_AUTH should return error\n    - setopt: setting PROXYUSERPWD after PROXYUSERNAME/PASSWORD is fine\n    - sshserver.pl: adjust `AuthorizedKeysFile2` cutoff version\n    - sshserver: fix excluding obsolete client config lines\n    - SSLCERTS: list support for SSL_CERT_FILE and SSL_CERT_DIR\n    - tftpd: prefix TFTP protocol error `E*` constants with `TFTP_`\n    - tool_operate: fail SSH transfers without server auth\n    - url: call protocol handler's disconnect in Curl_conn_free\n    - urlapi: remove percent encoded dot sequences from the URL path\n    - urldata: remove 'hostname' from struct Curl_async\n\n- Update to 8.12.1:\n  \n  * Bugfixes:\n    - asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'\n    - asyn-thread: fix HTTPS RR crash\n    - asyn-thread: fix the returned bitmask from Curl_resolver_getsock\n    - asyn-thread: survive a c-ares channel set to NULL\n    - cmake: always reference OpenSSL and ZLIB via imported targets\n    - cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'\n    - cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'\n    - content_encoding: #error on too old zlib\n    - imap: TLS upgrade fix\n    - ldap: drop support for legacy Novell LDAP SDK\n    - libssh2: comparison is always true because rc \u003c= -1\n    - libssh2: raise lowest supported version to 1.2.8\n    - libssh: drop support for libssh older than 0.9.0\n    - openssl-quic: ignore ciphers for h3\n    - pop3: TLS upgrade fix\n    - runtests: fix the disabling of the memory tracking\n    - runtests: quote commands to support paths with spaces\n    - scache: add magic checks\n    - smb: silence '-Warray-bounds' with gcc 13+\n    - smtp: TLS upgrade fix\n    - tool_cfgable: sort struct fields by size, use bitfields for booleans\n    - tool_getparam: add \"TLS required\" flag for each such option\n    - vtls: fix multissl-init\n    - wakeup_write: make sure the eventfd write sends eight bytes\n\n- Update to 8.12.0:\n  \n  * Changes:\n    - curl: add byte range support to --variable reading from file\n    - curl: make --etag-save acknowledge --create-dirs\n    - getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var\n    - getinfo: provide info which auth was used for HTTP and proxy\n    - hyper: drop support\n    - openssl: add support to use keys and certificates from PKCS#11 provider\n    - QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA\n    - vtls: feature ssls-export for SSL session im-/export\n  \n  * Bugfixes:\n    - altsvc: avoid integer overflow in expire calculation\n    - asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL\n    - asyn-ares: fix memory leak\n    - asyn-ares: initial HTTPS resolve support\n    - asyn-thread: use c-ares to resolve HTTPS RR\n    - async-thread: avoid closing eventfd twice\n    - cd2nroff: do not insist on quoted \u003c\u003e within backticks\n    - cd2nroff: support \"none\" as a TLS backend\n    - conncache: count shutdowns against host and max limits\n    - content_encoding: drop support for zlib before 1.2.0.4\n    - content_encoding: namespace GZIP flag constants\n    - content_encoding: put the decomp buffers into the writer structs\n    - content_encoding: support use of custom libzstd memory functions\n    - cookie: cap expire times to 400 days\n    - cookie: parse only the exact expire date\n    - curl: return error if etag options are used with multiple URLs\n    - curl_multi_fdset: include the shutdown connections in the set\n    - curl_sha512_256: rename symbols to the curl namespace\n    - curl_url_set.md: adjust the added-in to 7.62.0\n    - doh: send HTTPS RR requests for all HTTP(S) transfers\n    - easy: allow connect-only handle reuse with easy_perform\n    - easy: make curl_easy_perform() return error if connection still there\n    - easy_lock: use Sleep(1) for thread yield on old Windows\n    - ECH: update APIs to those agreed with OpenSSL maintainers\n    - GnuTLS: fix 'time_appconnect' for early data\n    - HTTP/2: strip TE request header\n    - http2: fix data_pending check\n    - http2: fix value stored to 'result' is never read\n    - http: ignore invalid Retry-After times\n    - http_aws_sigv4: Fix invalid compare function handling zero-length pairs\n    - https-connect: start next immediately on failure\n    - lib: redirect handling by protocol handler\n    - multi: fix curl_multi_waitfds reporting of fd_count\n    - netrc: 'default' with no credentials is not a match\n    - netrc: fix password-only entries\n    - netrc: restore _netrc fallback logic\n    - ngtcp2: fix memory leak on connect failure\n    - openssl: define `HAVE_KEYLOG_CALLBACK` before use\n    - openssl: fix ECH logic\n    - osslq: use SSL_poll to determine writeability of QUIC streams\n    - sectransp: free certificate on error\n    - select: avoid a NULL deref in cwfds_add_sock\n    - src: omit hugehelp and ca-embed from libcurltool\n    - ssl session cache: change cache dimensions\n    - system.h: add 64-bit curl_off_t definitions for NonStop\n    - telnet: handle single-byte input option\n    - TLS: check connection for SSL use, not handler\n    - tool_formparse.c: make curlx_uztoso a static in here\n    - tool_formparse: accept digits in --form type= strings\n    - tool_getparam: ECH param parsing refix\n    - tool_getparam: fail --hostpubsha256 if libssh2 is not used\n    - tool_getparam: fix \"Ignored Return Value\"\n    - tool_getparam: fix memory leak on error in parse_ech\n    - tool_getparam: fix the ECH parser\n    - tool_operate: make --etag-compare always accept a non-existing file\n    - transfer: fix CURLOPT_CURLU override logic\n    - urlapi: fix redirect to a new fragment or query (only)\n    - vquic: make vquic_send_packets not return without setting psent\n    - vtls: fix default SSL backend as a fallback\n    - vtls: only remember the expiry timestamp in session cache\n    - websocket: fix message send corruption\n    - x509asn1: add parse recursion limit\n","status":"published","published":"2025-09-25T10:52:04Z","modified":"2026-03-23T04:47:19.583665Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21077-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)\n- CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n\nOther fixes:\n- tool_operate: fix return code when --retry is used but not\n  triggered (bsc#1249367)\n","status":"published","published":"2025-11-26T14:28:47Z","modified":"2026-03-23T04:51:10.319584Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21145-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)\n- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)\n- CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)\n\nOther fixes:\n- tool_operate: fix return code when --retry is used but not\n  triggered (bsc#1249367)\n","status":"published","published":"2025-11-26T14:28:47Z","modified":"2026-03-23T04:51:14.109641Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"USN-8062-1","title":"curl vulnerabilities","description":"It was discovered that curl incorrectly handled cookies when redirected\nfrom secure to insecure connections. An attacker could possibly use this\nissue to cause a denial of service, or obtain sensitive information.\nThis issue only affected Ubuntu 25.10. (CVE-2025-9086)\n\nCalvin Ruocco discovered that curl did not properly handle WebSocket\ncommunications under certain circumstances. A malicious server could\npossibly use this issue to poison proxy caches with malicious content.\nThis issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.\n(CVE-2025-10148)\n\nStanislav Fort discovered that wcurl did not properly handle URLs with\ncertain encoded characters. If a user were tricked into processing\na specially crafted URL, an attacker could possibly use this issue to\nwrite files outside the intended directory. This issue only affected\nUbuntu 25.10. (CVE-2025-11563)\n\nStanislav Fort discovered that curl did not properly validate pinned\npublic keys under certain circumstances. A remote attacker could\npossibly use this issue to perform a machine-in-the-middle attack. This\nissue only affected Ubuntu 25.10.(CVE-2025-13034)\n\nStanislav Fort discovered that curl did not properly manage TLS options\nwhen performing LDAP over TLS transfers in multi-threaded environments.\nUnder certain circumstances, certificate verification could be\nunintentionally and unknowingly disabled. (CVE-2025-14017)\n\nIt was discovered that curl incorrectly handled Oauth2 bearer tokens\nwhen following redirects. A remote attacker could possibly use this\nissue to obtain authentication credentials. (CVE-2025-14524)\n\nStanislav Fort discovered that curl did not properly validate TLS\ncertificates when reusing connections. A remote attacker could possibly\nuse this issue to bypass expected certificate verification. This issue\nonly affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)\n\nHarry Sintonen discovered that curl did not properly validate SSH host\nkeys when performing SSH-based file transfers. This issue could lead to\nunintended bypass of custom known_hosts file. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)\n\nHarry Sintonen discovered that curl built with libssh did not properly\nhandle authentication when performing SSH-based file transfers. This\ncould result in unintended authentication operations. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)","status":"published","published":"2026-02-25T00:34:27Z","modified":"2026-04-27T18:47:19.528380495Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}