DEBIAN-CVE-2025-9086

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2025-9086
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-9086.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-9086
Upstream
Published
2025-09-12T06:15:44Z
Modified
2025-09-18T06:33:58.782483Z
Summary
[none]
Details
  1. A cookie is set using the secure keyword for https://target 2. curl is redirected to or otherwise made to speak with http://target (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (path='/'). Since this site is not secure, the cookie should just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
References

Affected packages

Debian:11 / curl

Package

Name
curl
Purl
pkg:deb/debian/curl?arch=source

Affected ranges

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / curl

Package

Name
curl
Purl
pkg:deb/debian/curl?arch=source

Affected ranges

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / curl

Package

Name
curl
Purl
pkg:deb/debian/curl?arch=source

Affected ranges

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / curl

Package

Name
curl
Purl
pkg:deb/debian/curl?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.16.0~rc2-1

Affected versions

8.*

8.14.1-2
8.14.1-2+exp1
8.15.0~rc1-1exp1
8.15.0~rc2-1~exp1
8.15.0~rc3-1~exp1
8.15.0-1~bpo13+1
8.15.0-1~exp1
8.15.0-1
8.16.0~rc1-1~exp1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}