Heap Buffer Vulnerability in cURL Exposing Secure Cookies

CVE-2025-9086

What is CVE-2025-9086?

A vulnerability in cURL allows an attacker to exploit a flaw in the handling of secure cookies. When a secure cookie is set for a secure connection and a subsequent request is made to the same hostname over an insecure HTTP connection, a bug in the path comparison logic may incorrectly allow the insecure site to override the secure cookie. This behavior can lead to unexpected results, including potential crashes or data exposure. The issue stems from an incorrect buffer handling that reads outside the allocated memory, presenting a significant security risk for applications relying on secure cookie mechanisms.

References