VDB
RHSA-2026:2485
RHSA-2026:2485
PUBLISHED
CVSS 5.300000190734863 MEDIUM
An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:975a1e501a8520df83f3f4114e72a71384ff1866ec99c7a45fffbf8c76ef5cbc_arm64 as a component of Red Hat Insights proxy 1.5 | * |
| Red Hat | registry.redhat.io/insights-proxy/insights-proxy-container-rhel9@sha256:ab86ba36e62e8aec5ba48e9e0076b1f8086c48157c85990be0e2ce3e03273016_amd64 as a component of Red Hat Insights proxy 1.5 | *, * |
Timeline
- Feb 10, 2026 CVE Published
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- Jul 27, 2026 CVE Updated
References
- https://access.redhat.com/security/cve/CVE-2025-14104 advisory
- https://access.redhat.com/security/cve/CVE-2025-15467 advisory
- https://access.redhat.com/security/cve/CVE-2025-66199 advisory
- https://access.redhat.com/security/cve/CVE-2025-68973 advisory
- https://access.redhat.com/security/cve/CVE-2025-69419 advisory
- https://access.redhat.com/security/cve/CVE-2025-69420 advisory
- https://access.redhat.com/security/cve/CVE-2025-69421 advisory
- https://access.redhat.com/security/cve/CVE-2026-22795 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2394750 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-9086 advisory
- https://curl.se/docs/CVE-2025-9086.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2430375 issue
- https://www.cve.org/CVERecord?id=CVE-2025-11187 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-11187 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2416741 issue
- https://www.cve.org/CVERecord?id=CVE-2025-13601 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-13601 advisory
- https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4914 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2419369 issue
…and 58 more