CVE-2025-9086 is a vulnerability in curl's path comparison logic that causes an out-of-bounds read of heap memory. This flaw can result in a segmentation fault or crash and may allow a clear-text site to override secure cookie contents depending on adjacent memory data. The vulnerability affects Red Hat Discovery and related products that use curl. Red Hat has not yet released an official patch or mitigation that meets their standards. The vulnerability is tracked under Red Hat Advisory RHSA-2026:1736 and involves multiple CWE categories including CWE-125 (Out-of-bounds Read).

An attacker could cause a denial of service by crashing the application through out-of-bounds memory reads. Additionally, the vulnerability may allow bypassing cookie security by letting a clear-text site override secure cookie contents, potentially exposing sensitive session data. The flaw could also leak memory contents that might aid in bypassing protection mechanisms such as ASLR. No confirmed active exploitation is reported.

Currently, Red Hat does not provide an official fix or mitigation that meets their criteria for deployment and stability. Users are advised to monitor Red Hat advisories for updates. No workaround or temporary fix is recommended by Red Hat at this time. Customers with a Technical Account Manager (TAM) can consult directly for guidance. Upgrading to a fixed version when available is recommended once Red Hat releases a patch.