CVE-2025-9086 Out of bounds read for cookie path
An out-of-bounds read in curl's cookie path comparison can cause crashes or allow insecure sites to override secure cookies.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-9086?
CVE-2025-9086 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 12 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary
The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
Weakness: CWE-125
Which versions are affected by CVE-2025-9086?
It affects 2 products.
Linux distribution packages (40)
curl AlmaLinux:10 | All versions | 8.12.1-2.el10_1.2 |
libcurl AlmaLinux:10 | All versions | 8.12.1-2.el10_1.2 |
libcurl-devel AlmaLinux:10 | All versions | 8.12.1-2.el10_1.2 |
libcurl-minimal AlmaLinux:10 | All versions | 8.12.1-2.el10_1.2 |
curl AlmaLinux:8 | All versions | 7.61.1-34.el8_10.9 |
libcurl AlmaLinux:8 | All versions | 7.61.1-34.el8_10.9 |
libcurl-devel AlmaLinux:8 | All versions | 7.61.1-34.el8_10.9 |
libcurl-minimal AlmaLinux:8 | All versions | 7.61.1-34.el8_10.9 |
curl AlmaLinux:9 | All versions | 7.76.1-35.el9_7.3 |
curl-minimal AlmaLinux:9 | All versions | 7.76.1-35.el9_7.3 |
libcurl AlmaLinux:9 | All versions | 7.76.1-35.el9_7.3 |
libcurl-devel AlmaLinux:9 | All versions | 7.76.1-35.el9_7.3 |
libcurl-minimal AlmaLinux:9 | All versions | 7.76.1-35.el9_7.3 |
curl Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
curl-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
curl-debugsource Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
libcurl Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
libcurl-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
libcurl-devel Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
libcurl-minimal Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:10.1 | All versions | 0:8.12.1-2.el10_1.2 |
curl Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
curl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
curl-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
curl-minimal-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
libcurl Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
libcurl-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
libcurl-devel Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
libcurl-minimal Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 0:7.61.1-34.el8_10.9 |
curl-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-35.el9_7.3 |
curl-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-35.el9_7.3 |
curl-minimal-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-35.el9_7.3 |
libcurl-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-35.el9_7.3 |
libcurl-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-35.el9_7.3 |
libcurl-minimal-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:7.76.1-35.el9_7.3 |
curl Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-35.el9_7.3 |
curl-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-35.el9_7.3 |
curl-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-35.el9_7.3 |
curl-minimal Red Hat:enterprise_linux:9::baseos | All versions | 0:7.76.1-35.el9_7.3 |
Products include Debian Debian Linux, Haxx Curl.
How do I fix CVE-2025-9086?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-9086 being exploited?
There is no known exploitation of CVE-2025-9086 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2025-9086, ALSA-2025:23383, ALSA-2026:1350, ALSA-2026:1825, BELL-CVE-2025-9086, CLEANSTART-2026-VE90255 and 26 more.