Out-of-bounds read in cURL - CVE-2025-9086

Vulnerability identifier: #VU115138

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L]

CVE-ID: CVE-2025-9086

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when reading cookie path. A malicious server can set a specially crafted cookie path using the secure keyword, trigger an out-of-bounds read error and crash the application.

cURL
IBM Qradar SIEM
SUSE Manager Proxy 4.3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Manager Retail Branch Server 4.3
SUSE Manager Server 4.3
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Real Time 15
visionOS
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
SUSE Enterprise Storage
IBM AIX
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
macOS
Ubuntu
Basesystem Module
openSUSE Leap
tvOS
Apple iOS
iPadOS
openEuler
watchOS
Fedora
InfoSphere Data Replication for z/OS Remote Source
Financial Transaction Manager for RedHat OpenShift
CICS Transaction Gateway for Multiplatforms
Tenable Identity Exposure (formerly Tenable.ad)
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Oracle Communications Unified Inventory Management
Infrastructure Technology
AppDynamics NodeJS Agent
IBM TXSeries for Multiplatforms
Communications Unified Assurance
LANTIME Operating System Firmware (LTOS)
Juniper Secure Analytics (JSA)
MySQL Enterprise Backup
PeopleSoft Enterprise PeopleTools
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libbrotlidec1-debuginfo
libbrotlienc1-32bit
libbrotlidec1-32bit-debuginfo
libbrotlicommon1-32bit-debuginfo
libbrotlienc1-32bit-debuginfo
libbrotlicommon1-32bit
libbrotlidec1-32bit
libbrotlidec1
brotli-debugsource
libbrotlicommon1-debuginfo
libbrotli-devel
libbrotlienc1
libbrotlicommon1
brotli
brotli-debuginfo
libbrotlienc1-debuginfo
curl (Ubuntu package)
libcurl
curl-doc
libcurl-minimal
libcurl-devel
curl-minimal
curl
curl (Red Hat package)
curl-debuginfo
curl-debugsource
curl-help
libcurl4
libcurl4-debuginfo
libcurl4-32bit
libcurl4-debuginfo-32bit
libcurl4-32bit-debuginfo
libcurl4-64bit
libcurl4-64bit-debuginfo
libcurl-mini4
curl-zsh-completion
curl-fish-completion
libcurl-devel-doc
libcurl-devel-32bit
libcurl-mini4-debuginfo
curl-mini-debugsource
libcurl-devel-64bit
Oracle Commerce Guided Search
OpenShift Virtualization
IBM CICS TX Standard

Install updates from vendor's website.

cURL - update to 8.16.0
visionOS - update to 26.2
Tenable Identity Exposure (formerly Tenable.ad) - update to 3.77.14
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 5
LANTIME Operating System Firmware (LTOS) - update to 7.10.004
Juniper Secure Analytics (JSA) - update to 7.5.0 UP15 IF01
MySQL Enterprise Backup - addressed in versions 8.0.44, 8.4.7, 9.5.0
macOS - addressed in versions 14.8.3 23J220, 15.7.3 24G419, 26.2 25C56
tvOS - update to 26.2 23K54
Apple iOS - addressed in versions 18.7.3 22H217, 26.2 23C55
iPadOS - addressed in versions 18.7.3 22H217, 26.2 23C55
AppDynamics NodeJS Agent - update to 25.12.1
watchOS - update to 26.2 23S303
libbrotlidec1-debuginfo - update to 1.0.7-150200.3.5.1
libbrotlienc1-32bit - update to 1.0.7-150200.3.5.1
libbrotlidec1-32bit-debuginfo - update to 1.0.7-150200.3.5.1
libbrotlicommon1-32bit-debuginfo - update to 1.0.7-150200.3.5.1
libbrotlienc1-32bit-debuginfo - update to 1.0.7-150200.3.5.1
libbrotlicommon1-32bit - update to 1.0.7-150200.3.5.1
libbrotlidec1-32bit - update to 1.0.7-150200.3.5.1
libbrotlidec1 - update to 1.0.7-150200.3.5.1
brotli-debugsource - update to 1.0.7-150200.3.5.1
libbrotlicommon1-debuginfo - update to 1.0.7-150200.3.5.1
libbrotli-devel - update to 1.0.7-150200.3.5.1
libbrotlienc1 - update to 1.0.7-150200.3.5.1
libbrotlicommon1 - update to 1.0.7-150200.3.5.1
brotli - update to 1.0.7-150200.3.5.1
brotli-debuginfo - update to 1.0.7-150200.3.5.1
libbrotlienc1-debuginfo - update to 1.0.7-150200.3.5.1
OpenShift Virtualization - update to 4.19.17
IBM Qradar SIEM - update to 7.5.0 Update Pack 14 IF04
curl (Ubuntu package) - addressed in versions 7.35.0-1ubuntu2.20+esm19, 7.47.0-1ubuntu2.19+esm15, 7.58.0-2ubuntu3.24+esm7, 7.68.0-1ubuntu2.25+esm2, 7.81.0-1ubuntu1.22, 8.5.0-2ubuntu10.7, 8.14.1-2ubuntu1.1
libcurl - addressed in versions 7.61.1-35.0.2, 8.4.0-12
curl-doc - addressed in versions 7.61.1-35.0.2, 8.4.0-12
libcurl-minimal - addressed in versions 7.61.1-35.0.2, 8.4.0-12
libcurl-devel - addressed in versions 7.61.1-35.0.2, 8.4.0-12
curl-minimal - addressed in versions 7.61.1-35.0.2, 8.4.0-12
curl - addressed in versions 7.61.1-35.0.2, 8.4.0-12
curl (Red Hat package) - addressed in versions 7.76.1-14.el9_0.12, 7.76.1-23.el9_2.8, 7.76.1-29.el9_4.3, 7.76.1-31.el9_6.2, 7.76.1-35.el9_7.3, 8.12.1-1.el10_0.4, 8.12.1-2.el10_1.2
curl - update to 7.79.1-42
curl-debuginfo - update to 7.79.1-42
curl-debugsource - update to 7.79.1-42
libcurl - update to 7.79.1-42
libcurl-devel - update to 7.79.1-42
curl-help - update to 7.79.1-42
libcurl4 - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
curl-debugsource - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
curl - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl4-debuginfo - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
curl-debuginfo - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl-devel - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl4-32bit - addressed in versions 8.0.1-11.108.1, 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl4-debuginfo-32bit - update to 8.0.1-11.108.1
curl - addressed in versions 8.9.1-4.fc41, 8.11.1-6.fc42, 8.15.0-7.fc43
libcurl4-32bit-debuginfo - addressed in versions 8.14.1-150200.4.91.1, 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl4-64bit - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl4-64bit-debuginfo - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl-mini4 - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
curl-zsh-completion - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
curl-fish-completion - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl-devel-doc - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl-devel-32bit - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl-mini4-debuginfo - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
curl-mini-debugsource - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
libcurl-devel-64bit - addressed in versions 8.14.1-150400.5.69.1, 8.14.1-150600.4.28.1
IBM TXSeries for Multiplatforms - update to 11.1.0.0 ifix18
IBM CICS TX Standard - update to 11.1.0.0 ifix41

• https://curl.se/docs/CVE-2025-9086.html

• Multiple vulnerabilities in cURL
• SUSE update for curl
• SUSE update for curl
• Fedora 41 update for curl
• SUSE update for curl
• SUSE update for curl
• Fedora 42 update for curl
• openEuler update for curl
• Anolis OS update for curl
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Tenable Identity Exposure 3.77 update for third-party components
• Meinberg LANTIME firmware update for third-party components
• Red Hat Enterprise Linux 9 update for curl
• Red Hat Enterprise Linux 9 update for curl
• Red Hat Enterprise Linux 9 update for curl
• Red Hat Enterprise Linux 9 update for curl
• IBM AIX update for libcurl
• Multiple vulnerabilities in Apple macOS Tahoe
• Multiple vulnerabilities in Apple visionOS
• Multiple vulnerabilities in Apple tvOS
• Multiple vulnerabilities in Apple watchOS
• Multiple vulnerabilities in Apple macOS Sonoma
• Multiple vulnerabilities in Apple iOS 26 and iPadOS 26
• Multiple vulnerabilities in Apple iOS 18 and iPadOS 18
• Multiple vulnerabilities in macOS Sequoia
• Anolis OS update for curl
• Multiple vulnerabilities in Oracle Commerce Guided Search
• Multiple vulnerabilities in MySQL Enterprise Backup
• Multiple vulnerabilities in PeopleSoft Enterprise PeopleTools
• Multiple vulnerabilities in OpenShift Virtualization 4.19
• Red Hat Enterprise Linux 9 update for curl
• Red Hat Enterprise Linux 10 update for curl
• Multiple vulnerabilities in IBM QRadar SIEM
• Red Hat Enterprise Linux 10 update for curl
• Multiple vulnerabilities in IBM Financial Transaction Manager (FTM) for RedHat OpenShift
• Ubuntu update for curl
• Ubuntu update for curl
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Splunk AppDynamics NodeJS Agent update for third-party components
• Multiple vulnerabilities in Communications Unified Assurance
• Multiple vulnerabilities in Infrastructure Technology
• Multiple vulnerabilities in IBM TXSeries for Multiplatforms
• Multiple vulnerabilities in IBM CICS TX Standard
• Multiple vulnerabilities in Juniper Secure Analytics
• Fedora 43 update for curl
• IBM InfoSphere Data Replication for z/OS Remote Source update for curl
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge