Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2025-9086
Good to know:
Date: September 10, 2025
Out of bounds read for cookie path in curl 7.31.0 to and including 8.15.0. An attacker needs to be in control of the `http://` site that uses the same name as the `https://` version, or otherwise possess MITM capability, which probably makes this problem the lesser one. The attacker has no way to control or guess what is in the heap memory following the path buffer that is being read out of bounds, making it a fragile operation. The vulnerability is fixed in 8.16.0.
Severity Score
Severity Score
Weakness Type (CWE)
Out-of-bounds Read
CWE-125Top Fix
Upgrade Version
Upgrade to version libcurl - null;https://github.com/curl/curl.git - curl-8_16_0
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | NETWORK |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | NONE |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | NONE |
| Integrity (I): | NONE |
| Availability (A): | LOW |