Moderate Vulnerability in curl Package: Out of Bounds Read in Cookie Path
Summary
ALSA-2026:1825: Moderate: curl security update. Affects curl versions < 8.12.1-2.el10_1.2. Fixed in 8.12.1-2.el10_1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package provides the libcurl library and the curl utility, which are essential for downloading files from servers using various protocols such as HTTP, FTP, and LDAP. It is widely used in various applications for its robust features and reliability. However, the curl package is susceptible to a security vulnerability that can lead to potential data exposure.
Vulnerability Detail
The vulnerability identified as CVE-2025-9086 is an out-of-bounds read issue in the curl package. This flaw can allow attackers to read memory beyond the intended buffer, potentially exposing sensitive data. The vulnerability arises from improper handling of cookie paths, which can be exploited to gain unauthorized access to information. The ramifications of this vulnerability can be severe, as it may lead to data leaks or unauthorized data manipulation.
How To Fix
Minimum fixed version
8.12.1-2.el10_1.2
This is the first release that contains the fix.
sudo dnf update curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider restricting access to the affected application or disabling cookie handling until the package is updated. However, this is not a permanent solution and should only be used until the patch is applied.
Conclusion
The curl package is critical for various applications, but it is currently affected by a moderate vulnerability (CVE-2025-9086) that can lead to serious security risks. Updating to the latest patched version is essential to mitigate these risks. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for curl →
FAQ
CVE-2025-9086 is a security vulnerability in the curl package that allows for an out-of-bounds read, potentially exposing sensitive data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing temporary workarounds such as restricting access to the affected application.
The potential impacts include unauthorized access to sensitive data, data leaks, and possible exploitation by attackers.
It is advisable to regularly monitor your applications for vulnerabilities, ideally using tools like Vulert to receive real-time alerts.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
