1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary
The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade curl-minimalUpgrade libcurlUpgrade libcurl-minimalUpgrade libcurl-develUpgrade curl | Dec 23, 2025 | Dec 16, 2025 |
| Alpine Linux | — | Upgrade curl | Oct 7, 2025 | Sep 12, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade curl-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade curl-minimalUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade libcurl-debuginfoUpgrade curlUpgrade curl-debuginfoUpgrade libcurl-develUpgrade curl-debugsource | Jan 12, 2026 | Sep 12, 2025 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Dec 15, 2025 | Dec 12, 2025 |
| Debian | — | Upgrade curl | Jan 6, 2026 | Jan 6, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade curlUpgrade libcurl | Nov 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libcurlUpgrade curl | Dec 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Nov 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade curlUpgrade libcurl | Nov 21, 2025 | Nov 6, 2025 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory8 | Feb 25, 2026 | Dec 10, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Mar 26, 2026 |
| Oracle_linux | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl-minimalUpgrade libcurlUpgrade curl-minimal | Dec 22, 2025 | Sep 12, 2025 |
| Redhat_linux | — | Upgrade libcurl-minimalUpgrade libcurl-develUpgrade curlUpgrade libcurlUpgrade libcurl-minimal-debuginfoUpgrade curl-minimalUpgrade libcurl-debuginfoUpgrade curl-minimal-debuginfoUpgrade curl-debugsourceNo solution existsUpgrade curl-debuginfo | Dec 12, 2025 | Sep 12, 2025 |
| Rocky_linux | — | Upgrade libcurl-minimalUpgrade libcurl-develUpgrade curl-debugsourceUpgrade curl-minimal-debuginfoUpgrade curlUpgrade libcurl-minimal-debuginfoUpgrade curl-debuginfoUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curl-minimal | Feb 2, 2026 | Jan 30, 2026 |
| Suse | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl4 | Dec 5, 2025 | Sep 11, 2025 |
| Ubuntu | — | Upgrade libcurl3-gnutlsUpgrade libcurl3t64-gnutlsUpgrade libcurl4-gnutls-devUpgrade libcurl3-nssUpgrade libcurl4-nss-devUpgrade libcurl4t64Upgrade curlUpgrade libcurl4Upgrade libcurl4-openssl-dev | Feb 26, 2026 | Feb 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub