1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

The version of Tenable Identity Exposure (formerly Tenable.ad) installed on the remote host is prior to 3.77.14. It therefore contains vulnerable versions of third-party components (.NET, SQL Server, and curl). Tenable has upgraded these components to address the potential impact of the issues, including the following:

  - Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an     authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.     (CVE-2025-49718)

  - A cookie is set using the `secure` keyword for `https://target`. Curl is redirected to or otherwise made to speak     with `http://target` (same hostname, but using clear text HTTP) using the same cookie set. The same cookie name is     set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie should just be     ignored. A bug in the path comparison logic makes curl read outside a heap buffer boundary. The bug either causes a     crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the     contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following     the single-byte allocation that holds the path. (CVE-2025-9086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987465 advisory.

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987455 advisory.

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4daec13254 advisory.

    - fix Out of bounds read for cookie path (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-97ae15dc56 advisory.

    - Fix Out of bounds read for cookie path (CVE-2025-9086)
    - Fix predictable WebSocket mask (CVE-2025-10148)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03268-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03267-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure,     the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap     buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong     conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03198-1 advisory.

    Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

    Security issues fixed:

    - CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
    - CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
    - CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that     are not       easily noticed (bsc#1243706).
    - CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when     processing       specially crafted packets (bsc#1243933).
    - CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the     macidn IDN       backend (bsc#1228260).
    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix wrong return code when --retry is used (bsc#1249367).
      * tool_operate: fix return code when --retry is used but not triggered [b42776b]

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Fixed with version 8.14.1:
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03173-1 advisory.

    - CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Curl installed on the remote host is 7.31.0 prior to 8.16.0. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-9086 advisory.

  - A cookie is set using the secure keyword for https://target. Curl is redirected to or otherwise made to     speak with http://target (same hostname, but using clear text HTTP) using the same cookie set. The same     cookie name is set - but with just a slash as path (path='/'). Since this site is not secure, the cookie     should just be ignored. A bug in the path comparison logic makes curl read outside a heap buffer     boundary. (CVE-2025-9086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
272257	Tenable Identity Exposure < 3.77.14 Multiple Vulnerabilities (TNS-2025-23)	Nessus	Misc.	critical
271953	Photon OS 5.0: Curl PHSA-2025-5.0-0660	Nessus	PhotonOS Local Security Checks	medium
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	high
268806	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2025-987465)	Nessus	Unity Linux Local Security Checks	high
268123	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2025-987455)	Nessus	Unity Linux Local Security Checks	high
265716	Fedora 41 : curl (2025-4daec13254)	Nessus	Fedora Local Security Checks	high
265679	Fedora 42 : curl (2025-97ae15dc56)	Nessus	Fedora Local Security Checks	medium
265421	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2025:03268-1)	Nessus	SuSE Local Security Checks	medium
265417	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2025:03267-1)	Nessus	SuSE Local Security Checks	medium
264804	Linux Distros Unpatched Vulnerability : CVE-2025-9086	Nessus	Misc.	high
264667	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2025:03198-1)	Nessus	SuSE Local Security Checks	medium
264615	SUSE SLES12 Security Update : curl (SUSE-SU-2025:03173-1)	Nessus	SuSE Local Security Checks	high
264603	Curl 7.31.0 < 8.16.0 Out of Bounds Read (CVE-2025-9086)	Nessus	Misc.	low

Detections

Analytics

CVE-2025-9086

high

Tenable Plugins

critical

medium

high

high

high

high

medium

medium

medium

high

medium

high

low