Out of bounds read for cookie path in curl 7.31.0 to and including 8.15.0. An attacker needs to be in control of the `http://` site that uses the same name as the `https://` version, or otherwise possess MITM capability, which probably makes this problem the lesser one. The attacker has no way to control or guess what is in the heap memory following the path buffer that is being read out of bounds, making it a fragile operation. The vulnerability is fixed in 8.16.0.