CVE-2025-9086

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

• CWE-125
• CWE-125

• https://curl.se/docs/CVE-2025-9086.htmlPatch, Vendor Advisory
• https://curl.se/docs/CVE-2025-9086.jsonVendor Advisory
• https://hackerone.com/reports/3294999Exploit, Issue Tracking, Third Party Advisory
• https://www.openwall.com/lists/oss-security/2025/09/10/1Mailing List, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2026/01/msg00002.htmlMailing List, Third Party Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-089022.html
• https://cert-portal.siemens.com/productcert/html/ssa-253495.html

Published

Sep 12, 2025

Last Modified

Sep 14, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-9080The Generic Elements plugin for WordPress is vulnerable to S…6.4
• CVE-2025-9081Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail…6.5
• CVE-2025-9082The WPBITS Addons For Elementor plugin for WordPress is vuln…6.4
• CVE-2025-9083The Ninja Forms WordPress plugin before 3.11.1 unserializes…9.8
• CVE-2025-9084Mattermost versions 10.5.x <= 10.5.9 fail to properly valida…6.1
• CVE-2025-9085The User Registration & Membership plugin for WordPress is v…4.9
• CVE-2025-9087A vulnerability has been found in Tenda AC20 16.03.08.12. Th…9.8
• CVE-2025-9088A vulnerability was found in Tenda AC20 16.03.08.12. This vu…9.8
• CVE-2025-9089A vulnerability was determined in Tenda AC20 16.03.08.12. Th…9.8
• CVE-2025-9090A vulnerability was identified in Tenda AC20 16.03.08.12. Af…9.8
• CVE-2025-9091A security flaw has been discovered in Tenda AC20 16.03.08.1…7.8
• CVE-2025-9092Uncontrolled Resource Consumption vulnerability in Legion of…1