CVE-2025-9086
Full vulnerability record from the local CVENow database.
Description
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
Severity
HIGH
CVSS score
7.5
(v3.1)
Vulnerability status
Modified
Source identifier
2499f714-1537-4658-8207-48ae4bb9eae9
Published
2025-09-12 06:15:44.100000
Last modified
2026-10-19 17:10:00.173000
View original CVE JSON
{
"id": "CVE-2025-9086",
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
"published": "2025-09-12T06:15:44.100",
"lastModified": "2026-10-19T17:10:00.173",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
},
{
"lang": "es",
"value": "1. Una cookie se establece usando la palabra clave 'secure' para 'https://target'\n2. curl es redirigido o se le hace comunicarse con 'http://target' (el mismo nombre de host, pero usando HTTP en texto claro) usando el mismo conjunto de cookies\n3. Se establece el mismo nombre de cookie, pero con solo una barra como ruta ('path=“/”',). Dado que este sitio no es seguro, la cookie debería simplemente ser ignorada.\n4. Un error en la lógica de comparación de rutas hace que curl lea fuera de los límites de un búfer de pila\n\nEl error causa un fallo o potencialmente hace que la comparación llegue a una conclusión errónea y permite que el sitio de texto claro sobrescriba el contenido de la cookie segura, contrariamente a lo esperado y dependiendo del contenido de la memoria inmediatamente posterior a la asignación de un solo byte que contiene la ruta.\n\nEl comportamiento presunto y correcto sería ignorar simplemente el segundo establecimiento de la cookie, ya que ya se había establecido como segura en un host seguro, por lo que sobrescribirla en un host inseguro no debería ser aceptable."
}
],
"affected": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"affectedData": [
{
"vendor": "curl",
"product": "curl",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.13.0",
"lessThan": "8.14.2",
"versionType": "semver",
"status": "affected"
},
{
"version": "8.15.0",
"lessThan": "8.16.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "curl",
"product": "curl",
"defaultStatus": "unaffected",
"repo": "https://github.com/curl/curl.git",
"versions": [
{
"version": "1aea05a6c2699e80c75936d58569851555acd603",
"lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "curl",
"product": "curl",
"defaultStatus": "unaffected",
"versions": [
{
"version": "8.15.0",
"status": "affected"
},
{
"version": "8.14.1",
"status": "affected"
},
{
"version": "8.14.0",
"status": "affected"
},
{
"version": "8.13.0",
"status": "affected"
}
]
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V4.0",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCH328",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM324",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM328",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM332",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230 V AC, 12xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230 V AC, 8xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24 V DC, 12xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24 V DC, 8xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
"defaultStatus": "unknown",
"versions": [
{
"version": "0",
"lessThan": "V3.3",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-12T17:15:47.921625Z",
"id": "CVE-2025-9086",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
},
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
"versionStartIncluding": "8.13.0",
"versionEndExcluding": "8.16.0",
"matchCriteriaId": "4979D5F1-8D49-4EC0-AC6B-230636A10C34"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
]
}
]
}
],
"references": [
{
"url": "https://curl.se/docs/CVE-2025-9086.html",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Patch",
"Vendor Advisory"
]
},
{
"url": "https://curl.se/docs/CVE-2025-9086.json",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://hackerone.com/reports/3294999",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
]
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/09/10/1",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
]
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
]
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
]
}