This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Curl fixes 2 vulnerabilities
Curl fixes 2 vulnerabilities with version 8.16.0 [1][2].
An unauthenticated remote attacker can, under certain unpredictable circumstances, overwrite a cookie with the "Secure" attribute or carry out a DoS attack [1].
The vulnerability is present in product:
- Curl; >=7.31.0, <8.16.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
More information:
- CVE-2025-9086 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2025.
An unauthenticated remote attacker can, under certain specific circumstances, spoof WebSocket communication and thereby poison the cache of a proxy that treats the communication as valid HTTP content. Exploiting the vulnerability requires unencrypted communication using the WebSocket protocol [2].
The vulnerability is present in product:
- Curl; >=8.11.0, <8.16.0;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
More information:
- CVE-2025-10148 at cve.org, NVD
- CWE-340: Generation of Predictable Numbers or Identifiers at cwe.mitre.org
The vulnerability was publicly disclosed 10. 9. 2025.
By CESNET, z.s.p.o. Martin Krajči on 15. 9. 2025.