{
  "schema_version": "1.5.0",
  "id": "CURL-CVE-2025-9086",
  "aliases": [
    "CVE-2025-9086"
  ],
  "summary": "Out of bounds read for cookie path",
  "modified": "2026-05-19T11:21:50.00Z",
  "database_specific": {
    "package": "curl",
    "affects": "lib",
    "URL": "https://curl.se/docs/CVE-2025-9086.json",
    "www": "https://curl.se/docs/CVE-2025-9086.html",
    "issue": "https://hackerone.com/reports/3294999",
    "CWE": {
      "id": "CWE-125",
      "desc": "Out-of-bounds Read"
    },
    "award": {
      "amount": "505",
      "currency": "USD"
    },
    "last_affected": "8.15.0",
    "severity": "Low"
  },
  "published": "2025-09-10T08:00:00.00Z",
  "affected": [
    {
      "ranges": [
        {
           "type": "SEMVER",
           "events": [
             {"introduced": "8.13.0"},
             {"fixed": "8.16.0"}
           ]
        },
        {
           "type": "GIT",
           "repo": "https://github.com/curl/curl.git",
           "events": [
             {"introduced": "1aea05a6c2699e80c75936d58569851555acd603"},
             {"fixed": "c6ae07c6a541e0e96d0040afb62b45dd37711300"}
           ]
        }
      ],
      "versions": [
        "8.15.0", "8.14.1", "8.14.0", "8.13.0"
      ]
    }
  ],
  "credits": [
    {
      "name": "Google Big Sleep",
      "type": "FINDER"
    },
    {
      "name": "Daniel Stenberg",
      "type": "REMEDIATION_DEVELOPER"
    }
  ],
  "details": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n   hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n   Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n   boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
}