1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a slash as path (`path="/"`). Since this site is not secure, the cookie *should* be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary
The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade curl-minimalUpgrade libcurlUpgrade libcurl-develUpgrade libcurl-minimalUpgrade curl | Dec 23, 2025 | Dec 16, 2025 |
| Alpine Linux | — | Upgrade curl | Oct 7, 2025 | Sep 12, 2025 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade libcurlUpgrade curlUpgrade curl-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libcurl-debuginfoUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-develUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade curlUpgrade libcurl-minimalUpgrade curl-minimalUpgrade libcurl-minimal-debuginfo | Jan 12, 2026 | Sep 12, 2025 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Dec 15, 2025 | Dec 12, 2025 |
| Debian | — | Upgrade curl | Jan 6, 2026 | Jan 6, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade curlUpgrade libcurl | Nov 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Dec 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Nov 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade libcurlUpgrade curl | Nov 21, 2025 | Nov 6, 2025 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory8 | Feb 25, 2026 | Dec 10, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Mar 26, 2026 |
| Oracle_linux | — | Upgrade curlUpgrade libcurl-minimalUpgrade libcurl-develUpgrade libcurlUpgrade curl-minimal | Dec 22, 2025 | Sep 12, 2025 |
| Redhat_linux | — | Upgrade curl-minimal-debuginfoUpgrade curl-debuginfoNo solution existsUpgrade curl-debugsourceUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade libcurl-minimal-debuginfoUpgrade libcurl-develUpgrade libcurl-minimalUpgrade curl | Dec 12, 2025 | Sep 12, 2025 |
| Rocky_linux | — | Upgrade curlUpgrade libcurl-minimalUpgrade curl-debuginfoUpgrade curl-minimal-debuginfoUpgrade libcurl-develUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-minimal | Feb 2, 2026 | Jan 30, 2026 |
| Suse | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl4 | Dec 5, 2025 | Sep 11, 2025 |
| Ubuntu | — | Upgrade curlUpgrade libcurl4t64Upgrade libcurl4-nss-devUpgrade libcurl3-nssUpgrade libcurl4Upgrade libcurl4-openssl-devUpgrade libcurl3-gnutlsUpgrade libcurl3t64-gnutlsUpgrade libcurl4-gnutls-dev | Feb 26, 2026 | Feb 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub