Detections
Analytics
Alpine: libcurl, multiple curl packages: security update to 8.14.1-r2
medium Tenable Self-Hosted Container Security Plugin ID 435497
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise
made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not
secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside
a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the
wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to
expectations and depending on the memory contents immediately following the single-byte allocation that
holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie
since it was already set as secure on a secure host so overriding it on an insecure host should not be
okay. (CVE-2025-9086)
- curl's websocket code did not update the 32 bit mask pattern for each new outgoing frame as the
specification says. Instead it used a fixed mask that persisted and was used throughout the entire
connection. A predictable mask pattern allows for a malicious server to induce traffic between the two
communicating parties that could be interpreted by an involved proxy (configured or transparent) as
genuine, real, HTTP traffic with content and thereby poison its cache. That cached poisoned content could
then be served to all users of that proxy. (CVE-2025-10148)
See Also
Plugin Details
Severity: Medium
ID: 435497
Version: Revision 1.4
Type: Local
Published: 10/2/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.39
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-9086
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Temporal Score: 4.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2025-10148
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 9/11/2025
Reference Information
CVE: CVE-2025-10148, CVE-2025-9086
IAVA: 2025-A-0657