CVE-2025-9086: Out of bounds read for cookie path | LiveThreat CVE Feed

High severity · published Sep 12, 2025

CVE-2025-9086

Out of bounds read for cookie path

7.5

CVSS

1.5%

EPSS

On KEV

Description

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.5% · higher than 74% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

curl · curl

8.13.0 before 8.14.2; 8.15.0 before 8.16.0; 1aea05a6c2699e80c75936d58569851555acd603 before c6ae07c6a541e0e96d0040afb62b45dd37711300; 8.15.0; 8.14.1; 8.14.0; +1 more · source: vendor, NVD

Debian Linux · Debian

11.0 · source: NVD

RUGGEDCOM RST2428P · Siemens

before V3.3; before V4.0 · source: CISA

SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · Siemens

before V3.3 · source: CISA

SCALANCE XCH328 · Siemens

before V3.3 · source: CISA

SCALANCE XCM324 · Siemens

before V3.3 · source: CISA

SCALANCE XCM328 · Siemens

before V3.3 · source: CISA

SCALANCE XCM332 · Siemens

before V3.3 · source: CISA

SCALANCE XRH334 (24 V DC, 8xFO, CC) · Siemens

before V3.3 · source: CISA

SCALANCE XRM334 (230 V AC, 12xFO) · Siemens

before V3.3 · source: CISA

SCALANCE XRM334 (230 V AC, 8xFO) · Siemens

before V3.3 · source: CISA

SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) · Siemens

before V3.3 · source: CISA

In the news

VulnerabilityHigh

Siemens SINEC OS

View CSAF Summary SINEC OS before V3.3 contains third-party components with multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions. The following versions of Siemens SINEC OS are affected: RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665, CVE-2025-0725, CVE-2025-1390, CVE-2025-3360, CVE-2025-4138, CVE-2025-4330, CVE-2025-4373, CVE-2025-4435, CVE-2025-4516, CVE-2025-4517, CVE-2025-6141, CVE-2025-9086, CVE-2025-9230, CVE-2025-9231, CVE-2025-9232, CVE-2025-10148, CVE-2025-27587, CVE-2025-32433, CVE-2025-38084, CVE-2025-38085, CVE-2025-38086, CVE-2025-38345, CVE-2025-38350, CVE-2025-38498, CVE-2025-39839, CVE-2025-39841, CVE-2025-39846, CVE-2025-39853, CVE-2025-39860, CVE-2025-39864, CVE-2025-39865, CVE-2025-59375) SCALANCE XCH328 (6GK5328-4TS01-2EC2) vers:intdot/<3.3 (CVE-2022-48174, CVE-2023-7256, CVE-2023-39810, CVE-2023-42363, CVE-2023-42364, CVE-2023-42365, CVE-2023-42366, CVE-2024-6197, CVE-2024-6874, CVE-2024-7264, CVE-2024-8006, CVE-2024-8096, CVE-2024-9681, CVE-2024-11053, CVE-2024-12718, CVE-2024-41996, CVE-2024-47619, CVE-2024-52533, CVE-2025-0167, CVE-2025-0665...

CVE-2022-48174 CVE-2023-7256 CVE-2023-39810

Feb 12, 2026·CISA Advisories

Affected product

curl

All curl CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-9086

CVE.org

https://www.cve.org/CVERecord?id=CVE-2025-9086

Patch

https://curl.se/docs/CVE-2025-9086.html