CVE-2025-9086
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk71th percentile - higher than 71% of all known CVEs
Summary
A bug in curl's cookie path comparison logic makes curl read outside a heap buffer boundary. The scenario involves a cookie set with the secure keyword for https://target, a redirect to http://target (same hostname, clear text HTTP), and the same cookie name set with only a slash as path ("/"). The bug either causes a crash or makes the comparison come to the wrong conclusion, letting the clear-text site override the contents of the secure cookie.
Risk Assessment
This may cause an application crash or allow an insecure site to override a secure cookie, potentially leading to session hijacking or data exposure.
Recommendation
Update curl to a version containing the fix for the cookie path comparison bug.
Other vulnerabilities in curl
See all- CVE-2022-27775High
An information disclosure vulnerability exists in curl versions 7.65.0 to 7.82.0 that allows reusing a connection using an IPv6 address with a different zone id.
- CVE-2022-22576High
An improper authentication vulnerability exists in curl versions 7.33.0 to 7.82.0 which might allow reuse of OAUTH2-authenticated connections without properly ensuring that the connection was authenticated with the same credentials. This affects SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S), and LDAP(S) (openldap only).
- CVE-2024-11053Low
When curl is asked to use a `.netrc` file for credentials and to follow HTTP redirects, it could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests if the netrc file has an entry matching the redirect target hostname.
- CVE-2024-8096Medium
When curl is told to use the Certificate Status Request TLS extension (OCSP stapling) to verify the server certificate, it might fail to detect some OCSP problems and wrongly consider the response as fine if the returned status reports another error than expected.
- CVE-2024-9681Medium
When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise intended. This affects applications using HSTS and URLs with the insecure HTTP:// scheme.
- CVE-2026-8926Critical
When curl uses a .netrc file for credentials and a URL with a username (without password) is specified, curl may wrongly retrieve and use the password of another user from .netrc for that host if no match exists for the specified user.
- CVE-2026-8925Critical
A double-free vulnerability has been found in the curl library's SASL authentication handling. The GSASL context is cleaned up twice without clearing the pointer, causing free() to be called on the same memory region twice.
- CVE-2026-8924Critical
A flaw in curl's cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check, enabling injection of cookies that curl scopes and sends to unrelated third-party domains.
- CVE-2023-38545Critical
CVE-2023-38545 is a vulnerability related to heap buffer overflow during the SOCKS5 proxy handshake in curl. The issue arises when curl passes a hostname that is too long to the proxy, leading to incorrect data copying.
- CVE-2026-80255High
A Set-Cookie header using a tab (ASCII 9) instead of a space (ASCII 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Original NVD description (English source)
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.