Is CVE-2025-9086 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 1%.

What products does CVE-2025-9086 affect?

Tracked products affected include curl. Check the version you run to see whether it is affected.

How do I fix CVE-2025-9086?

Apply the vendor fix promptly. An official patch or advisory is available. Upgrade affected products to a fixed version.

← All products

CVE-2025-9086

Q: What is CVE-2025-9086?

CVE-2025-9086 is a high-severity software vulnerability (Out-of-bounds read) with a CVSS score of 7.5. 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name

HIGH severity · CVSS 7.5 · Out-of-bounds read

7.5CVSS HIGH

Summary

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

Confidentiality impactNone

Integrity impactNone

Availability impactHigh

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products we track (1)

curl

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://curl.se/docs/CVE-2025-9086.html ↗

CVE-2025-9086

Summary

Impact & exploitability

Affected products we track (1)

Recommendation

Additional information