CVE-2025-9086
Estado: ModificadaAlta (7.5)—
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary
The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
Leer descripción completaMostrar menos
The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.40%
- Percentil entre todas las CVEs puntuadas: 72
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access75 % - Impacto principal
T1499.004Application or System Exploitationimpact65 % - Impacto secundario
T1565.001Stored Data Manipulationimpact55 %
Vulnerabilidad de lectura fuera de límites (CWE-125) en curl remoto sin autenticación (AV:N/PR:N) que causa DoS (A:H) o corrupción de cookies seguras; explotable contra aplicaciones que usen curl con redireccionamientos HTTP/HTTPS.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (2)
CWE
- CWE-125
- CWE-125
Referencias
- https://curl.se/docs/CVE-2025-9086.html
- https://curl.se/docs/CVE-2025-9086.json
- https://hackerone.com/reports/3294999
- http://www.openwall.com/lists/oss-security/2025/09/10/1
- https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-9086",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-9086",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-09-12T17:15:47.921625Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"affectedData": [
{
"vendor": "curl",
"product": "curl",
"versions": [
{
"status": "affected",
"version": "8.13.0",
"lessThan": "8.14.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "8.15.0",
"lessThan": "8.16.0",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"repo": "https://github.com/curl/curl.git",
"vendor": "curl",
"product": "curl",
"versions": [
{
"status": "affected",
"version": "1aea05a6c2699e80c75936d58569851555acd603",
"lessThan": "c6ae07c6a541e0e96d0040afb62b45dd37711300",
"versionType": "git"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "curl",
"product": "curl",
"versions": [
{
"status": "affected",
"version": "8.15.0"
},
{
"status": "affected",
"version": "8.14.1"
},
{
"status": "affected",
"version": "8.14.0"
},
{
"status": "affected",
"version": "8.13.0"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
"affectedData": [
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "RUGGEDCOM RST2428P",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V4.0",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XCH328",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM324",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM328",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XCM332",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRH334 (24 V DC, 8xFO, CC)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230 V AC, 12xFO)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230 V AC, 8xFO)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24 V DC, 12xFO)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24 V DC, 8xFO)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230 V AC, 12xFO)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230 V AC, 8xFO)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"vendor": "Siemens",
"product": "SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+)",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3.3",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-09-12T06:15:44.100",
"references": [
{
"url": "https://curl.se/docs/CVE-2025-9086.html",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://curl.se/docs/CVE-2025-9086.json",
"tags": [
"Vendor Advisory"
],
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "https://hackerone.com/reports/3294999",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"source": "2499f714-1537-4658-8207-48ae4bb9eae9"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/09/10/1",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/01/msg00002.html",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-089022.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
},
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "1. A cookie is set using the `secure` keyword for `https://target`\n2. curl is redirected to or otherwise made to speak with `http://target` (same\n hostname, but using clear text HTTP) using the same cookie set\n3. The same cookie name is set - but with only a slash as path (`path=\"/\"`).\n Since this site is not secure, the cookie *should* be ignored.\n4. A bug in the path comparison logic makes curl read outside a heap buffer\n boundary\n\nThe bug either causes a crash or it potentially makes the comparison come to\nthe wrong conclusion and lets the clear-text site override the contents of the\nsecure cookie, contrary to expectations and depending on the memory contents\nimmediately following the single-byte allocation that holds the path.\n\nThe presumed and correct behavior would be to plainly ignore the second set of\nthe cookie since it was already set as secure on a secure host so overriding\nit on an insecure host should not be okay."
}
],
"lastModified": "2026-09-14T21:16:59.523",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4979D5F1-8D49-4EC0-AC6B-230636A10C34",
"versionEndExcluding": "8.16.0",
"versionStartIncluding": "8.13.0"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9"
}