CVE-2025-9086

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9086", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2025-08-16T05:40:23.800Z", "datePublished": "2025-09-12T05:10:03.815Z", "dateUpdated": "2026-09-15T06:02:35.281Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:35.281Z"}, "title": "Out of bounds read for cookie path", "descriptions": [{"lang": "en", "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.13.0", "status": "affected", "versionType": "semver", "lessThan": "8.14.2"}, {"version": "8.15.0", "status": "affected", "versionType": "semver", "lessThan": "8.16.0"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "1aea05a6c2699e80c75936d58569851555acd603", "status": "affected", "versionType": "git", "lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300"}], "defaultStatus": "unaffected", "repo": "https://github.com/curl/curl.git"}, {"vendor": "curl", "product": "curl", "versions": [{"version": "8.15.0", "status": "affected"}, {"version": "8.14.1", "status": "affected"}, {"version": "8.14.0", "status": "affected"}, {"version": "8.13.0", "status": "affected"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2025-9086.json"}, {"url": "https://curl.se/docs/CVE-2025-9086.html"}, {"url": "https://hackerone.com/reports/3294999"}], "x_osv": {"schema_version": "1.5.0", "id": "CURL-CVE-2025-9086", "aliases": ["CVE-2025-9086"], "summary": "Out of bounds read for cookie path", "modified": "2026-09-07T10:34:51.00Z", "database_specific": {"package": "curl", "affects": "lib", "URL": "https://curl.se/docs/CVE-2025-9086.json", "www": "https://curl.se/docs/CVE-2025-9086.html", "issue": "https://hackerone.com/reports/3294999", "CWE": {"id": "CWE-125", "desc": "Out-of-bounds Read"}, "award": {"amount": "505", "currency": "USD"}, "last_affected": "8.15.0", "severity": "Low"}, "published": "2025-09-10T08:00:00.00Z", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.13.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.0"}]}, {"type": "GIT", "repo": "https://github.com/curl/curl.git", "events": [{"introduced": "1aea05a6c2699e80c75936d58569851555acd603"}, {"fixed": "c6ae07c6a541e0e96d0040afb62b45dd37711300"}]}], "versions": ["8.15.0", "8.14.1", "8.14.0", "8.13.0"]}], "credits": [{"name": "Google Big Sleep", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Read", "cweId": "CWE-125", "type": "CWE"}]}], "credits": [{"lang": "en", "value": "Google Big Sleep", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T17:15:47.921625Z", "id": "CVE-2025-9086", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T17:16:20.317Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-05T02:47:38.406Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T12:59:46.514Z"}, "affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCH328", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM324", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM328", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM332", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 12xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 8xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 12xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 8xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-01-05T02:47:38.406Z"}}, {"affected": [{"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "RUGGEDCOM RST2428P", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCH328", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM324", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM328", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XCM332", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 12xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (230 V AC, 8xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 12xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (24 V DC, 8xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)", "versions": [{"status": "affected", "version": "0", "lessThan": "V3.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-06-02T12:59:46.514Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-9086", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T17:15:47.921625Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T17:16:09.204Z"}}], "cna": {"title": "Out of bounds read for cookie path", "x_osv": {"id": "CURL-CVE-2025-9086", "aliases": ["CVE-2025-9086"], "credits": [{"name": "Google Big Sleep", "type": "finder"}, {"name": "Daniel Stenberg", "type": "remediation developer"}], "details": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay.", "summary": "Out of bounds read for cookie path", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "8.13.0"}, {"fixed": "8.14.2"}, {"introduced": "8.15.0"}, {"fixed": "8.16.0"}]}, {"repo": "https://github.com/curl/curl.git", "type": "GIT", "events": [{"introduced": "1aea05a6c2699e80c75936d58569851555acd603"}, {"fixed": "c6ae07c6a541e0e96d0040afb62b45dd37711300"}]}], "versions": ["8.15.0", "8.14.1", "8.14.0", "8.13.0"]}], "modified": "2026-09-07T10:34:51.00Z", "published": "2025-09-10T08:00:00.00Z", "schema_version": "1.5.0", "database_specific": {"CWE": {"id": "CWE-125", "desc": "Out-of-bounds Read"}, "URL": "https://curl.se/docs/CVE-2025-9086.json", "www": "https://curl.se/docs/CVE-2025-9086.html", "award": {"amount": "505", "currency": "USD"}, "issue": "https://hackerone.com/reports/3294999", "affects": "lib", "package": "curl", "severity": "Low", "last_affected": "8.15.0"}}, "credits": [{"lang": "en", "type": "finder", "value": "Google Big Sleep"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Stenberg"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.13.0", "lessThan": "8.14.2", "versionType": "semver"}, {"status": "affected", "version": "8.15.0", "lessThan": "8.16.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"repo": "https://github.com/curl/curl.git", "vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "1aea05a6c2699e80c75936d58569851555acd603", "lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300", "versionType": "git"}], "defaultStatus": "unaffected"}, {"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2025-9086.json"}, {"url": "https://curl.se/docs/CVE-2025-9086.html"}, {"url": "https://hackerone.com/reports/3294999"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-15T06:02:35.281Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9086", "state": "PUBLISHED", "dateUpdated": "2026-09-15T06:02:35.281Z", "dateReserved": "2025-08-16T05:40:23.800Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2025-09-12T05:10:03.815Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThan": "8.14.2", "status": "affected", "version": "8.13.0", "versionType": "semver"}, {"lessThan": "8.16.0", "status": "affected", "version": "8.15.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "curl", "repo": "https://github.com/curl/curl.git", "vendor": "curl", "versions": [{"lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300", "status": "affected", "version": "1aea05a6c2699e80c75936d58569851555acd603", "versionType": "git"}]}, {"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"status": "affected", "version": "8.15.0"}, {"status": "affected", "version": "8.14.1"}, {"status": "affected", "version": "8.14.0"}, {"status": "affected", "version": "8.13.0"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}, {"affectedData": [{"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "RUGGEDCOM RST2428P", "vendor": "Siemens", "versions": [{"lessThan": "V4.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCH328", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM324", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM328", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XCM332", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (230 V AC, 12xFO)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (230 V AC, 8xFO)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (24 V DC, 12xFO)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (24 V DC, 8xFO)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (2x230 V AC, 12xFO)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (2x230 V AC, 8xFO)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)", "vendor": "Siemens", "versions": [{"lessThan": "V3.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "matchCriteriaId": "4979D5F1-8D49-4EC0-AC6B-230636A10C34", "versionEndExcluding": "8.16.0", "versionStartIncluding": "8.13.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."}, {"lang": "es", "value": "1. Una cookie se establece usando la palabra clave 'secure' para 'https://target'\n2. curl es redirigido o se le hace comunicarse con 'http://target' (el mismo nombre de host, pero usando HTTP en texto claro) usando el mismo conjunto de cookies\n3. Se establece el mismo nombre de cookie, pero con solo una barra como ruta ('path=\u201c/\u201d',). Dado que este sitio no es seguro, la cookie deber\u00eda simplemente ser ignorada.\n4. Un error en la l\u00f3gica de comparaci\u00f3n de rutas hace que curl lea fuera de los l\u00edmites de un b\u00fafer de pila\n\nEl error causa un fallo o potencialmente hace que la comparaci\u00f3n llegue a una conclusi\u00f3n err\u00f3nea y permite que el sitio de texto claro sobrescriba el contenido de la cookie segura, contrariamente a lo esperado y dependiendo del contenido de la memoria inmediatamente posterior a la asignaci\u00f3n de un solo byte que contiene la ruta.\n\nEl comportamiento presunto y correcto ser\u00eda ignorar simplemente el segundo establecimiento de la cookie, ya que ya se hab\u00eda establecido como segura en un host seguro, por lo que sobrescribirla en un host inseguro no deber\u00eda ser aceptable."}], "id": "CVE-2025-9086", "lastModified": "2026-10-19T17:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9086", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-12T17:15:47.921625Z", "version": "2.0.3"}}]}, "published": "2025-09-12T06:15:44.100", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Patch", "Vendor Advisory"], "url": "https://curl.se/docs/CVE-2025-9086.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Vendor Advisory"], "url": "https://curl.se/docs/CVE-2025-9086.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://hackerone.com/reports/3294999"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2025/09/10/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-125"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "curl: libcurl: Curl out of bounds read for cookie path", "id": "2394750", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394750"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-125", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-9086", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Fix deferred", "package_name": "curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3:", "fix_state": "Fix deferred", "package_name": "devspaces-tech-preview/idea-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:trusted_profile_analyzer:2", "fix_state": "Fix deferred", "package_name": "rhtpa/rhtpa-trustification-service-rhel9", "product_name": "Red Hat Trusted Profile Analyzer"}], "public_date": "2025-09-12T05:10:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-9086\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-9086\nhttps://curl.se/docs/CVE-2025-9086.html\nhttps://curl.se/docs/CVE-2025-9086.json\nhttps://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6\nhttps://hackerone.com/reports/3294999"], "threat_severity": "Moderate"}

{"created": "2025-09-15T10:43:59.187814+00:00", "updated": "2025-09-15T10:43:59.187865+00:00", "vendors": ["curl", "curl$PRODUCT$curl"]}