Skip to content
OpenAdvisories
High DLA-4432-1 1 CVE

curl - security update

Published Jan 4, 2026 · Updated Jan 5, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 curl 7.74.0-1.3+deb11u16

Vulnerabilities 1

  • High 7.5
    CVE-2025-9086

    Out of bounds read for cookie path

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

    curl curl curl curl Debian Ubuntu Alpine