{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-9086","assignerOrgId":"2499f714-1537-4658-8207-48ae4bb9eae9","state":"PUBLISHED","assignerShortName":"curl","dateReserved":"2025-08-16T05:40:23.800Z","datePublished":"2025-09-12T05:10:03.815Z","dateUpdated":"2026-09-15T06:02:35.281Z"},"containers":{"cna":{"providerMetadata":{"orgId":"2499f714-1537-4658-8207-48ae4bb9eae9","shortName":"curl","dateUpdated":"2026-09-15T06:02:35.281Z"},"title":"Out of bounds read for cookie path","descriptions":[{"lang":"en","value":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."}],"affected":[{"vendor":"curl","product":"curl","versions":[{"version":"8.13.0","status":"affected","versionType":"semver","lessThan":"8.14.2"},{"version":"8.15.0","status":"affected","versionType":"semver","lessThan":"8.16.0"}],"defaultStatus":"unaffected"},{"vendor":"curl","product":"curl","versions":[{"version":"1aea05a6c2699e80c75936d58569851555acd603","status":"affected","versionType":"git","lessThan":"c6ae07c6a541e0e96d0040afb62b45dd37711300"}],"defaultStatus":"unaffected","repo":"https://github.com/curl/curl.git"},{"vendor":"curl","product":"curl","versions":[{"version":"8.15.0","status":"affected"},{"version":"8.14.1","status":"affected"},{"version":"8.14.0","status":"affected"},{"version":"8.13.0","status":"affected"}],"defaultStatus":"unaffected"}],"references":[{"url":"https://curl.se/docs/CVE-2025-9086.json"},{"url":"https://curl.se/docs/CVE-2025-9086.html"},{"url":"https://hackerone.com/reports/3294999"}],"x_osv":{"schema_version":"1.5.0","id":"CURL-CVE-2025-9086","aliases":["CVE-2025-9086"],"summary":"Out of bounds read for cookie path","modified":"2026-09-07T10:34:51.00Z","database_specific":{"package":"curl","affects":"lib","URL":"https://curl.se/docs/CVE-2025-9086.json","www":"https://curl.se/docs/CVE-2025-9086.html","issue":"https://hackerone.com/reports/3294999","CWE":{"id":"CWE-125","desc":"Out-of-bounds Read"},"award":{"amount":"505","currency":"USD"},"last_affected":"8.15.0","severity":"Low"},"published":"2025-09-10T08:00:00.00Z","affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.13.0"},{"fixed":"8.14.2"},{"introduced":"8.15.0"},{"fixed":"8.16.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"1aea05a6c2699e80c75936d58569851555acd603"},{"fixed":"c6ae07c6a541e0e96d0040afb62b45dd37711300"}]}],"versions":["8.15.0","8.14.1","8.14.0","8.13.0"]}],"credits":[{"name":"Google Big Sleep","type":"finder"},{"name":"Daniel Stenberg","type":"remediation developer"}],"details":"1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."},"problemTypes":[{"descriptions":[{"lang":"en","description":"Out-of-bounds Read","cweId":"CWE-125","type":"CWE"}]}],"credits":[{"lang":"en","value":"Google Big Sleep","type":"finder"},{"lang":"en","value":"Daniel Stenberg","type":"remediation developer"}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-09-12T17:15:47.921625Z","id":"CVE-2025-9086","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-09-12T17:16:20.317Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2025/09/10/1"},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2026-01-05T02:47:38.406Z"}},{"x_adpType":"supplier","providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-06-02T12:59:46.514Z"},"affected":[{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"RUGGEDCOM RST2428P","versions":[{"status":"affected","version":"0","lessThan":"V4.0","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCH328","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCM324","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCM328","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XCM332","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRH334 (24 V DC, 8xFO, CC)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (230 V AC, 12xFO)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (230 V AC, 8xFO)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (24 V DC, 12xFO)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (24 V DC, 8xFO)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (2x230 V AC, 12xFO)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (2x230 V AC, 8xFO)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)","versions":[{"status":"affected","version":"0","lessThan":"V3.3","versionType":"custom"}],"defaultStatus":"unknown"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-089022.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}