1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary
The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl-minimalUpgrade libcurlUpgrade curl-minimal | Dec 23, 2025 | Dec 16, 2025 |
| Alpine Linux | — | Upgrade curl | Oct 7, 2025 | Sep 12, 2025 |
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade libcurlUpgrade libcurl-develUpgrade curl-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade libcurl-minimal-debuginfoUpgrade curl-minimalUpgrade libcurl-minimalUpgrade curl-minimal-debuginfoUpgrade curl-debuginfoUpgrade libcurl-develUpgrade curlUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade libcurl | Jan 12, 2026 | Sep 12, 2025 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Dec 15, 2025 | Dec 15, 2025 |
| Debian | — | Upgrade curl | Jan 6, 2026 | Jan 6, 2026 |
| Dell Powerstore Dsa2026115 | — | Upgrade Dell PowerStoreOS to the latest version | Feb 25, 2026 | Feb 24, 2026 |
| Huawei Euleros 2_0_sp10 | — | Upgrade curlUpgrade libcurl | Nov 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Dec 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Nov 12, 2025 | Nov 6, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade curlUpgrade libcurl | Nov 21, 2025 | Nov 6, 2025 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory8 | Feb 25, 2026 | Dec 10, 2025 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Mar 26, 2026 |
| Oracle_linux | — | Upgrade libcurl-develUpgrade libcurl-minimalUpgrade curlUpgrade curl-minimalUpgrade libcurl | Dec 22, 2025 | Sep 12, 2025 |
| Redhat_linux | — | Upgrade libcurl-minimal-debuginfoUpgrade curl-minimalUpgrade libcurl-develUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curlUpgrade libcurl-minimalUpgrade curl-debuginfoNo solution existsUpgrade curl-minimal-debuginfoUpgrade curl-debugsource | Dec 12, 2025 | Sep 12, 2025 |
| Rocky_linux | — | Upgrade curlUpgrade libcurl-minimalUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade libcurl-develUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurlUpgrade libcurl-debuginfoUpgrade curl-minimal | Feb 2, 2026 | Jan 30, 2026 |
| Suse | — | Upgrade curlUpgrade libcurl4-32bitUpgrade libcurl-devel-32bitUpgrade libcurl-develUpgrade libcurl4 | Dec 5, 2025 | Sep 11, 2025 |
| Ubuntu | — | Upgrade libcurl4-gnutls-devUpgrade libcurl3-gnutlsUpgrade libcurl3t64-gnutlsUpgrade curlUpgrade libcurl4t64Upgrade libcurl4Upgrade libcurl4-nss-devUpgrade libcurl3-nssUpgrade libcurl4-openssl-dev | Feb 26, 2026 | Feb 25, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub