Summary
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: libcurl: Curl out of bounds read for cookie path (CVE-2025-9086)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | curl | 0:7.76.1-35.el9_7.3 |
Vulnerabilities 1
-
High 7.5
Out of bounds read for cookie path
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2394750