1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987465 advisory.

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987455 advisory.

    1. A cookie is set using the `secure` keyword for `https://target`     2. curl is redirected to or otherwise made to speak with `http://target` (same        hostname, but using clear text HTTP) using the same cookie set     3. The same cookie name is set - but with just a slash as path (`path='/'`).
       Since this site is not secure, the cookie *should* just be ignored.
    4. A bug in the path comparison logic makes curl read outside a heap buffer        boundary

    The bug either causes a crash or it potentially makes the comparison come to     the wrong conclusion and lets the clear-text site override the contents of the     secure cookie, contrary to expectations and depending on the memory contents     immediately following the single-byte allocation that holds the path.

    The presumed and correct behavior would be to plainly ignore the second set of     the cookie since it was already set as secure on a secure host so overriding     it on an insecure host should not be okay.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-4daec13254 advisory.

    - fix Out of bounds read for cookie path (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-97ae15dc56 advisory.

    - Fix Out of bounds read for cookie path (CVE-2025-9086)
    - Fix predictable WebSocket mask (CVE-2025-10148)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03268-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03267-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path='/'`). Since this site is not secure,     the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap     buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong     conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03198-1 advisory.

    Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

    Security issues fixed:

    - CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
    - CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
    - CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that     are not       easily noticed (bsc#1243706).
    - CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when     processing       specially crafted packets (bsc#1243933).
    - CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the     macidn IDN       backend (bsc#1228260).
    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix wrong return code when --retry is used (bsc#1249367).
      * tool_operate: fix return code when --retry is used but not triggered [b42776b]

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Fixed with version 8.14.1:
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03173-1 advisory.

    - CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Curl installed on the remote host is 7.31.0 prior to 8.16.0. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-9086 advisory.

  - A cookie is set using the secure keyword for https://target. Curl is redirected to or otherwise made to     speak with http://target (same hostname, but using clear text HTTP) using the same cookie set. The same     cookie name is set - but with just a slash as path (path='/'). Since this site is not secure, the cookie     should just be ignored. A bug in the path comparison logic makes curl read outside a heap buffer     boundary. (CVE-2025-9086)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
268806	Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: curl (UTSA-2025-987465)	Nessus	Unity Linux Local Security Checks	high
268123	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: curl (UTSA-2025-987455)	Nessus	Unity Linux Local Security Checks	high
265716	Fedora 41 : curl (2025-4daec13254)	Nessus	Fedora Local Security Checks	high
265679	Fedora 42 : curl (2025-97ae15dc56)	Nessus	Fedora Local Security Checks	medium
265421	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2025:03268-1)	Nessus	SuSE Local Security Checks	medium
265417	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2025:03267-1)	Nessus	SuSE Local Security Checks	medium
264804	Linux Distros Unpatched Vulnerability : CVE-2025-9086	Nessus	Misc.	high
264667	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2025:03198-1)	Nessus	SuSE Local Security Checks	medium
264615	SUSE SLES12 Security Update : curl (SUSE-SU-2025:03173-1)	Nessus	SuSE Local Security Checks	high
264603	Curl 7.31.0 < 8.16.0 Out of Bounds Read (CVE-2025-9086)	Nessus	Misc.	low

Detections

Analytics

CVE-2025-9086

high

Tenable Plugins

high

high

high

medium

medium

medium

high

medium

high

low