1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20090-1 advisory.

    - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
    - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)
    - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

    Other fixes:
    - tool_operate: fix return code when --retry is used but not       triggered (bsc#1249367)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libtiff packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the     function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null     pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is     rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and     may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply     a patch to fix this issue. One of the maintainers explains, that '[t]his error only occurs if     DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. 'rD') option is used.'(CVE-2025-8534)

    A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function     readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads     to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified     as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this     issue.(CVE-2025-8851)

Tenable has extracted the preceding description block directly from the EulerOS libtiff security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0744 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-9086:
    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same      hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
     Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer      boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.(CVE-2025-9086)

Tenable has extracted the preceding description block directly from the EulerOS curl security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3056 advisory.

    Out of bounds read for cookie path

    NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tenable Identity Exposure (formerly Tenable.ad) installed on the remote host is prior to 3.77.14. It therefore contains vulnerable versions of third-party components (.NET, SQL Server, and curl). Tenable has upgraded these components to address the potential impact of the issues, including the following:

  - Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an     authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.     (CVE-2025-49718)

  - A cookie is set using the `secure` keyword for `https://target`. Curl is redirected to or otherwise made to speak     with `http://target` (same hostname, but using clear text HTTP) using the same cookie set. The same cookie name is     set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie should just be     ignored. A bug in the path comparison logic makes curl read outside a heap buffer boundary. The bug either causes a     crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the     contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following     the single-byte allocation that holds the path. (CVE-2025-9086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987465 advisory.

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987455 advisory.

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4daec13254 advisory.

    - fix Out of bounds read for cookie path (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-97ae15dc56 advisory.

    - Fix Out of bounds read for cookie path (CVE-2025-9086)
    - Fix predictable WebSocket mask (CVE-2025-10148)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03268-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03267-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure,     the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap     buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong     conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03198-1 advisory.

    Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

    Security issues fixed:

    - CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
    - CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
    - CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that     are not       easily noticed (bsc#1243706).
    - CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when     processing       specially crafted packets (bsc#1243933).
    - CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the     macidn IDN       backend (bsc#1228260).
    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix wrong return code when --retry is used (bsc#1249367).
      * tool_operate: fix return code when --retry is used but not triggered [b42776b]

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Fixed with version 8.14.1:
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03173-1 advisory.

    - CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Curl installed on the remote host is 7.31.0 prior to 8.16.0. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-9086 advisory.

  - A cookie is set using the secure keyword for https://target. Curl is redirected to or otherwise made to     speak with http://target (same hostname, but using clear text HTTP) using the same cookie set. The same     cookie name is set - but with just a slash as path (path='/'). Since this site is not secure, the cookie     should just be ignored. A bug in the path comparison logic makes curl read outside a heap buffer     boundary. (CVE-2025-9086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
277017	openSUSE 16 Security Update : curl (openSUSE-SU-2025-20090-1)	Nessus	SuSE Local Security Checks	medium
276460	EulerOS 2.0 SP13 : libtiff (EulerOS-SA-2025-2438)	Nessus	Huawei Local Security Checks	high
275893	TencentOS Server 4: curl (TSSA-2025:0744)	Nessus	Tencent Local Security Checks	high
275306	Photon OS 4.0: Curl PHSA-2025-4.0-0903	Nessus	PhotonOS Local Security Checks	medium
274925	EulerOS 2.0 SP10 : curl (EulerOS-SA-2025-2382)	Nessus	Huawei Local Security Checks	high
274921	EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-2351)	Nessus	Huawei Local Security Checks	high
274917	EulerOS 2.0 SP10 : curl (EulerOS-SA-2025-2410)	Nessus	Huawei Local Security Checks	high
274885	EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-2320)	Nessus	Huawei Local Security Checks	high
274665	Amazon Linux 2 : curl, --advisory ALAS2-2025-3056 (ALAS-2025-3056)	Nessus	Amazon Linux Local Security Checks	high
272257	Tenable Identity Exposure < 3.77.14 Multiple Vulnerabilities (TNS-2025-23)	Nessus	Misc.	critical
271953	Photon OS 5.0: Curl PHSA-2025-5.0-0660	Nessus	PhotonOS Local Security Checks	medium
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	high
268806	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2025-987465)	Nessus	Unity Linux Local Security Checks	high
268123	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2025-987455)	Nessus	Unity Linux Local Security Checks	high
265716	Fedora 41 : curl (2025-4daec13254)	Nessus	Fedora Local Security Checks	high
265679	Fedora 42 : curl (2025-97ae15dc56)	Nessus	Fedora Local Security Checks	medium
265421	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2025:03268-1)	Nessus	SuSE Local Security Checks	medium
265417	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2025:03267-1)	Nessus	SuSE Local Security Checks	medium
264804	Linux Distros Unpatched Vulnerability : CVE-2025-9086	Nessus	Misc.	high
264667	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2025:03198-1)	Nessus	SuSE Local Security Checks	medium
264615	SUSE SLES12 Security Update : curl (SUSE-SU-2025:03173-1)	Nessus	SuSE Local Security Checks	high
264603	Curl 7.31.0 < 8.16.0 Out of Bounds Read (CVE-2025-9086)	Nessus	Misc.	low

Detections

Analytics

CVE-2025-9086

high

Tenable Plugins

medium

high

high

medium

high

high

high

high

high

critical

medium

high

high

high

high

medium

medium

medium

high

medium

high

low