{"id":"CVE-2025-9086","title":"1","summary":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name i…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-125"],"vendor":"haxx","product":"curl","affected":["curl >= 8.13.0, < 8.16.0","debian_linux = 11.0"],"patched":["curl 8.16.0"],"published":"2025-09-12","updated":"2026-09-14","sourceUpdated":"2026-09-14T21:16:59.523","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-9086","references":[{"url":"https://curl.se/docs/CVE-2025-9086.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2025-9086.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3294999","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/1","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.01395,"epssPercentile":0.71194,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-09-12T17:15:47.921625Z"},"ingestedAt":"2026-09-14T21:15:17.560Z","slug":"CVE-2025-9086","body":"## Overview\n\n1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.\n\n## Affected\n\n- `curl >= 8.13.0, < 8.16.0`\n- `debian_linux = 11.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.16.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}