Skip to content
OpenAdvisories
Medium ELSA-2025-23383 1 CVE

Moderate: curl security update (Oracle Linux 8)

Published Dec 18, 2025 · Updated Dec 18, 2025

Ecosystem: Oracle Linux

Summary

[7.61.1-34.el8_10.9]
- cookie: don't treat the leading slash as trailing (CVE-2025-9086)
Resolves: RHEL-121655

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 8 curl 0:7.61.1-34.el8_10.9
Oracle Linux · 8 libcurl 0:7.61.1-34.el8_10.9
Oracle Linux · 8 libcurl-devel 0:7.61.1-34.el8_10.9
Oracle Linux · 8 libcurl-minimal 0:7.61.1-34.el8_10.9

Vulnerabilities 1

  • High 7.5
    CVE-2025-9086

    Out of bounds read for cookie path

    1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

    curl curl curl curl Debian Ubuntu Alpine