CVE-2025-9086

What it actually does

The flaw triggers an out-of-bounds heap read during cookie path comparison when a secure cookie set over HTTPS is followed by an HTTP cookie with path=/ on the same host; the incorrect boundary check either crashes the process or allows the insecure cookie to incorrectly override the secure one based on adjacent heap memory contents.

Why it matters to the business

Applications using curl for HTTPS requests face risk of denial-of-service crashes or session-cookie tampering that can expose authenticated sessions or disrupt automated transfers; the issue affects any downstream software depending on the library.

How an attack unfolds

An attacker first ensures a secure cookie is set over HTTPS, then forces or redirects curl to the same hostname over plain HTTP while supplying a second cookie with path=/; the buggy path logic reads past the single-byte path allocation and either crashes or accepts the insecure override, contrary to the secure-cookie isolation rule.

How to fix it

Upgrade curl to the version containing commit 11b991232fbcaa88e2b1faecac224416b0001e35 or later; rebuild any statically linked dependents and re-test cookie-handling workflows after deployment.

How to confirm the fix worked

Confirm the installed curl binary reports a version built after commit 11b991232fbcaa88e2b1faecac224416b0001e35; replay the HTTPS-to-HTTP redirect cookie scenario in a controlled test and verify the secure cookie is not overridden and no crash occurs.

Typical attack path

1. Establish a secure cookie on the target host over HTTPS
2. Cause curl to follow a redirect or connect to the same host over HTTP
3. Supply a cookie of the same name with path=/ over the insecure channel
4. Trigger the path-comparison code path that performs the out-of-bounds read

How to detect it

Search process and application logs for curl segmentation faults or assertion failures immediately following HTTPS-to-HTTP redirects; inspect network traces for cookie headers containing path=/ sent over unencrypted channels to the same host that previously received a secure cookie.

What your security team should do

• Prioritize patching curl in all environments within the next maintenance window
• Scan build pipelines and container images for the vulnerable commit and replace with the fixed version
• Add curl version checks to dependency scanners and CI gates
• Monitor application logs for curl crashes correlated with HTTP redirects