curl: libcurl: Curl out of bounds read for cookie path

🗓️ 07 Apr 2026 15:43:21Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Curl path comparison out of bounds read flaw may crash or let clear text site override secure cookie.

Reporter	Title	Published	Views	Family All 244
IBM Security Bulletins	Security Bulletin: Muliple security vulnerabilities found in IBM CICS TX Standard.	22 Apr 202614:23	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is vulnerable to a denial of service (CVE-2025-9086) due to cURL libcurl	10 Dec 202523:03	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in curl affects IBM Netezza Appliance	16 Apr 202610:57	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities found in the Red Hat Universal Minimal Base Image shipped with CICS Transaction Gateway for Multiplatforms	5 Mar 202613:53	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in curl affects IBM Netezza Appliance	16 Apr 202609:29	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	28 Jan 202615:42	–	ibm
IBM Security Bulletins	Security Bulletin: curl vulnerability	18 May 202620:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Financial Transaction Manager is impacted by multiple vulnerabilities in RedHat Proxy for Kubernetes RBAC authorization	9 Feb 202614:45	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images	24 Mar 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of HCL BigFix , IBM Cloud Pak System is affected by multiple vulnerabilities	25 Jun 202600:02	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	any	aarch64	curl	8.19.0-3.hum1	curl-8.19.0-3.hum1.aarch64.rpm
Red Hat Hardened Images	any	x86_64	curl	8.19.0-3.hum1	curl-8.19.0-3.hum1.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-9086
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
curl	www.curl.se/docs/CVE-2025-9086.html
curl	www.curl.se/docs/CVE-2025-9086.json
github	www.github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6
hackerone	www.hackerone.com/reports/3294999
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-9086
cve	www.cve.org/CVERecord

19 Jul 2026 19:08Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.17.5

EPSS0.01301

SSVC

curl out of bounds path comparison heap buffer secure cookie clear text site