Junglewise Threat Intelligence

CVE-2025-9086: curl out-of-bounds read in cookie path comparison

CVE-2025-9086 · Severity: high · CVSS 7.5 · Published 2025-09-12

Technologies: Haxx Libcurl, Debian Linux, Haxx Curl. Vendors: Haxx, Debian.

Executive brief

A vulnerability in the curl library, which is widely used by applications to transfer data over the internet, could allow a malicious website to crash an application or bypass security settings for cookies. If a user is redirected from a secure (HTTPS) site to a non-secure (HTTP) version of the same site, the attacker could potentially overwrite secure login or session information. This could lead to service disruptions or unauthorized changes to how an application handles user sessions.

Technical details

An out-of-bounds read (CWE-125) exists in libcurl's cookie handling logic. When a cookie is initially set as 'secure' via HTTPS and the client is subsequently redirected to an insecure HTTP version of the same host, the insecure site may attempt to set a cookie with the same name and a path of '/'. Due to a bug in the path comparison logic, curl may perform a heap-based out-of-bounds read. This can result in a denial-of-service (crash) or, depending on adjacent memory contents, allow the insecure site to incorrectly override the secure cookie. The vulnerability affects libcurl versions 7.31.0 through 8.15.0 and is fixed in version 8.16.0.

Affected products

  • haxx curl 8.13.0 to 8.15.0
  • haxx libcurl 7.31.0 to 8.15.0

Timeline

  • 2025-08-11: disclosed: Reported to the curl project by Google Big Sleep
  • 2025-09-10: patched: Fixed in curl version 8.16.0
  • 2025-09-12: advisory: NVD publication date

References

Related threats