https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:32:27 +0000 https://cve.radiocsirt.org/vuln/alsa-2025:23383 <p><strong>Affected:</strong> AlmaLinux:8: curl, AlmaLinux:8: libcurl, AlmaLinux:8: libcurl-devel, AlmaLinux:8: libcurl-minimal</p> <p>The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.</p> <p>Security Fix(es):</p> <p>* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: curl, AlmaLinux:8: libcurl, AlmaLinux:8: libcurl-devel, AlmaLinux:8: libcurl-minimal</p> <p>The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.</p> <p>Security Fix(es):</p> <p>* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2025:23383 https://cve.radiocsirt.org/vuln/bdu:2025-12599 bdu:2025-12599 https://cve.radiocsirt.org/vuln/bdu:2025-12599 https://cve.radiocsirt.org/vuln/bell-cve-2025-9086 <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> <p><strong>Affected:</strong> Alpaquita:23: curl, Alpaquita:25: curl, Alpaquita:stream: curl, BellSoft Hardened Containers:stream: curl</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-9086 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0775 certfr-2025-avi-0775 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0775 https://cve.radiocsirt.org/vuln/cleanstart-2026-ay18527 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: curl</p> <p>Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: curl</p> <p>Multiple security vulnerabilities affect the curl package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ay18527 https://cve.radiocsirt.org/vuln/euvd-2026-368399 EUVD-2026-368399 https://cve.radiocsirt.org/vuln/euvd-2026-368399 https://cve.radiocsirt.org/vuln/fkie_cve-2025-9086 <p>1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path=&#34;/&#34;`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary</p> <p>The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.</p> <p>The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.</p> <p>1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path=&#34;/&#34;`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary</p> <p>The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.</p> <p>The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-9086 https://cve.radiocsirt.org/vuln/ghsa-v676-f8gm-92r9 <p>1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=&#39;/&#39;`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary</p> <p>The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.</p> <p>The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.</p> <p>1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=&#39;/&#39;`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary</p> <p>The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.</p> <p>The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.</p> https://cve.radiocsirt.org/vuln/ghsa-v676-f8gm-92r9 https://cve.radiocsirt.org/vuln/icsa-26-043-06 <p>There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl&#39;s ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…</p> <p>There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl&#39;s ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…</p> https://cve.radiocsirt.org/vuln/icsa-26-043-06 https://cve.radiocsirt.org/vuln/msrc_cve-2025-9086 msrc_CVE-2025-9086 https://cve.radiocsirt.org/vuln/msrc_cve-2025-9086 https://cve.radiocsirt.org/vuln/ncsc-2026-0020 NCSC-2026-0020 https://cve.radiocsirt.org/vuln/ncsc-2026-0020 https://cve.radiocsirt.org/vuln/oesa-2025-2319 <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: curl, openEuler:22.03-LTS-SP4: curl, openEuler:24.03-LTS: curl, openEuler:24.03-LTS-SP1: curl, openEuler:24.03-LTS-SP2: curl, openEuler:20.03-LTS-SP4: curl</p> <p>cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):</p> <p>curl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path=&amp;quot;/&amp;quot;, a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)</p> <p><strong>Affected:</strong> openEuler:22.03-LTS-SP3: curl, openEuler:22.03-LTS-SP4: curl, openEuler:24.03-LTS: curl, openEuler:24.03-LTS-SP1: curl, openEuler:24.03-LTS-SP2: curl, openEuler:20.03-LTS-SP4: curl</p> <p>cURL is a computer software project providing a library (libcurl) and command-line tool (curl) for transferring data using various protocols. Security Fix(es):</p> <p>curl contains an out-of-bounds read vulnerability in cookie path comparison logic. When a secure cookie is set via HTTPS and then the client is redirected to an insecure HTTP site using the same cookie name with path=&amp;quot;/&amp;quot;, a bug in path comparison logic causes reading beyond heap buffer boundaries. This may result in crashes or incorrectly allowing insecure sites to override secure cookie contents, contrary to security expectations. The attacker needs control of an HTTP site with the same name as the HTTPS version or MITM capability.(CVE-2025-9086)</p> https://cve.radiocsirt.org/vuln/oesa-2025-2319 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15590-1 <p>curl-8.16.0-1.1 on GA media</p> <p>curl-8.16.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15590-1 https://cve.radiocsirt.org/vuln/rhsa-2025:23125 <p>curl: libcurl: Curl out of bounds read for cookie path</p> <p>curl: libcurl: Curl out of bounds read for cookie path</p> https://cve.radiocsirt.org/vuln/rhsa-2025:23125 https://cve.radiocsirt.org/vuln/ssa-089022 <p>There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl&#39;s ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…</p> <p>There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution. In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400. An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1. A use-after-free vulnerability in BusyBox v.1.36.1 allows attackers to cause a denial of service via a crafted awk pattern in the awk.c evaluate function. A use-after-free vulnerability was discovered in BusyBox v.1.36.1 via a crafted awk pattern in the awk.c copyvar function. A heap-buffer-overflow was discovered in BusyBox v.1.36.1 in the next_token function at awk.c:1159. libcurl&#39;s ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `fr…</p> https://cve.radiocsirt.org/vuln/ssa-089022 https://cve.radiocsirt.org/vuln/suse-su-2025:03173-1 <p>Security update for curl</p> <p>Security update for curl</p> https://cve.radiocsirt.org/vuln/suse-su-2025:03173-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-9086 <p><strong>Affected:</strong> Ubuntu:25.10: curl</p> <p>1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path=&#34;/&#34;`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.</p> <p><strong>Affected:</strong> Ubuntu:25.10: curl</p> <p>1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path=&#34;/&#34;`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-9086 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2023 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Dateien zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2023