Skip to content
OpenAdvisories
Medium ALSA-2026:1825 1 CVE

Moderate: curl security update

Published Feb 3, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es):

* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 4

ReleasePackageFixed in
AlmaLinux · 10 curl 8.12.1-2.el10_1.2
AlmaLinux · 10 libcurl 8.12.1-2.el10_1.2
AlmaLinux · 10 libcurl-devel 8.12.1-2.el10_1.2
AlmaLinux · 10 libcurl-minimal 8.12.1-2.el10_1.2

Vulnerabilities 1

  • High 7.5
    CVE-2025-9086

    Out of bounds read for cookie path

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

    curl curl curl curl Debian Ubuntu Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-9086
  • report
    https://bugzilla.redhat.com/2394750
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-1825.html