Moderate Vulnerability in curl Package: Out of Bounds Read in Cookie Path
Summary
ALSA-2025:23383: Moderate: curl security update. Affects curl versions < 7.61.1-34.el8_10.9. Fixed in 7.61.1-34.el8_10.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility, which are essential for downloading files from servers using various protocols such as HTTP, FTP, and LDAP. This package is widely used in various applications and systems for its reliable file transfer capabilities. However, it is crucial to maintain its security to prevent potential exploits.
Vulnerability Detail
The vulnerability identified as CVE-2025-9086 is an out-of-bounds read issue in the curl package. This flaw can lead to unintended memory access, potentially exposing sensitive information or causing application crashes. The vulnerability arises from improper handling of cookie paths, which can be exploited by attackers to manipulate data or gain unauthorized access to system resources.
How To Fix
Minimum fixed version
7.61.1-34.el8_10.9
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the affected application or disabling features that utilize curl until the update can be applied. Additionally, monitor your application for any unusual activity that may indicate exploitation attempts.
Conclusion
The curl package has a moderate vulnerability (CVE-2025-9086) that can lead to serious security issues if not addressed. It is essential to update to the latest patched version to ensure the security of your applications. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for curl →
FAQ
CVE-2025-9086 is a vulnerability in the curl package that allows for an out-of-bounds read, potentially leading to information disclosure or application crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Failing to address this vulnerability could lead to unauthorized access to sensitive information, application instability, or exploitation by malicious actors.
Yes, you should update to version 7.61.1-34.el8_10.9 or later to mitigate the risks associated with this vulnerability.
Yes, using Vulert's playground, you can monitor and receive alerts for open-source vulnerabilities in your software without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
