Is CVE-2025-9086 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-9086 being exploited in the wild.

How severe is CVE-2025-9086?

High severity, with a CVSS score of 7.5, published 12 September 2025.

Which products and versions are affected?

Haxx Curl 8.13.0 to 8.15.0; Haxx Libcurl 7.31.0 to 8.15.0.

Is there a fix for CVE-2025-9086?

A patch was published on 2025-09-10: Fixed in curl version 8.16.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-9086 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-9086?

Check whether you run Debian Linux, Haxx Curl or Haxx Libcurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-9086: curl out-of-bounds read in cookie path comparison

CVE-2025-9086 · Severity: high · CVSS 7.5 · Published 2025-09-12

A vulnerability in the curl library, which is widely used by applications to transfer data over the internet, could allow a malicious website to crash an application or bypass security settings for cookies. If a user is redirected from a secure (HTTPS) site to a non-secure (HTTP) version of the same site, the attacker could potentially overwrite secure login or session information. This could lead to service disruptions or unauthorized changes to how an application handles user sessions.

Technologies: Debian Linux, Haxx Curl, Haxx Libcurl. Vendors: Debian, Haxx.

Quick answers

Is CVE-2025-9086 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-9086 being exploited in the wild.
How severe is CVE-2025-9086?: High severity, with a CVSS score of 7.5, published 12 September 2025.
Which products and versions are affected?: Haxx Curl 8.13.0 to 8.15.0; Haxx Libcurl 7.31.0 to 8.15.0.
Is there a fix for CVE-2025-9086?: A patch was published on 2025-09-10: Fixed in curl version 8.16.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-9086 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-9086?: Check whether you run Debian Linux, Haxx Curl or Haxx Libcurl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds read (CWE-125) exists in libcurl's cookie handling logic. When a cookie is initially set as 'secure' via HTTPS and the client is subsequently redirected to an insecure HTTP version of the same host, the insecure site may attempt to set a cookie with the same name and a path of '/'. Due to a bug in the path comparison logic, curl may perform a heap-based out-of-bounds read. This can result in a denial-of-service (crash) or, depending on adjacent memory contents, allow the insecure site to incorrectly override the secure cookie. The vulnerability affects libcurl versions 7.31.0 through 8.15.0 and is fixed in version 8.16.0.

Affected products

haxx curl 8.13.0 to 8.15.0
haxx libcurl 7.31.0 to 8.15.0

Timeline

2025-08-11: disclosed: Reported to the curl project by Google Big Sleep
2025-09-10: patched: Fixed in curl version 8.16.0
2025-09-12: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.