Skip to content
OpenAdvisories
Medium ALAS2023-2025-1351 5 CVEs

Moderate: curl security update (Amazon Linux 2023)

Published Jan 7, 2026 · Updated Jan 7, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2025-9086: Out of bounds read for cookie path NOTE: https://curl.se/docs/CVE-2025-9086.html NOTE: Introduced with: https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0) NOTE: Fixed by: https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) CVE-2025-10966: curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more. CVE-2025-10148: predictable WebSocket mask NOTE: https://curl.se/docs/CVE-2025-10148.html NOTE: Fixed by: https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (curl-8_16_0) CVE-2025-0167: When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance. CVE-2024-11053: When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 curl 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 curl-debuginfo 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 curl-debugsource 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 curl-minimal 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 curl-minimal-debuginfo 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 libcurl 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 libcurl-debuginfo 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 libcurl-devel 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 libcurl-minimal 0:8.15.0-4.amzn2023.0.1
Amazon Linux · 2023 libcurl-minimal-debuginfo 0:8.15.0-4.amzn2023.0.1

Vulnerabilities 5

  • High 7.5
    CVE-2025-9086

    Out of bounds read for cookie path

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

    curl curl curl curl Debian Ubuntu Alpine
  • Medium 5.3
    CVE-2025-10148

    predictable WebSocket mask

    curl's WebSocket code did not update the 32-bit mask pattern for each new outgoing frame as the specification says. Instead it used a fixed mask that persisted and was used throughout the entire connection. A predictable mask pattern allows for a malicious se…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2025-10966

    missing SFTP host verification with wolfSSH

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more.

    curl curl curl curl Debian Azure Linux Alpine
  • Low 3.4
    CVE-2024-11053

    netrc and redirect credential leak

    When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that …

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.4
    CVE-2025-0167

    netrc and default credential leak

    When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` ent…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-11053.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-0167.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-10148.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-10966.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-9086.html