CVE-2025-9086
published 2025-09-12CVE-2025-9086: 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but…
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
1.30%
67.2th percentile
1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (`path=\"/\",`).
Since this site is not secure, the cookie *should* just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer
boundary
The bug either causes a crash or it potentially makes the comparison come to
the wrong conclusion and lets the clear-text site override the contents of the
secure cookie, contrary to expectations and depending on the memory contents
immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly ignore the second set of
the cookie since it was already set as secure on a secure host so overriding
it on an insecure host should not be okay.
Affected
49 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios_18.7.3_and_ipados | — | — |
| apple | ios_26.2_and_ipados | — | — |
| apple | macos_sequoia | — | — |
| apple | macos_sonoma | — | — |
| apple | macos_tahoe | — | — |
| apple | tvos | — | — |
| apple | visionos | — | — |
| apple | watchos | — | — |
| curl | curl | 8.13.0 – 8.13.0 | — |
| curl | curl | 8.14.0 – 8.14.0 | — |
| curl | curl | 8.14.1 – 8.14.1 | — |
| curl | curl | 8.15.0 – 8.15.0 | — |
| debian | curl | < curl 8.16.0~rc2-1 (forky) | curl 8.16.0~rc2-1 (forky) |
| debian | debian_linux | — | — |
| haxx | curl | >= 0 < 8.14.1-r2 | 8.14.1-r2 |
| haxx | curl | >= 0 < 8.14.1-r2 | 8.14.1-r2 |
| haxx | curl | >= 0 < 8.14.1-r2 | 8.14.1-r2 |
| haxx | curl | >= 0 < 8.14.1-r2 | 8.14.1-r2 |
| haxx | curl | >= 0 < 8.16.0-r0 | 8.16.0-r0 |
| haxx | curl | >= 0 < 8.14.1-2+deb13u1 | 8.14.1-2+deb13u1 |
| haxx | curl | >= 0 < 8.16.0~rc2-1 | 8.16.0~rc2-1 |
| haxx | curl | >= 0 < 7.81.0-1ubuntu1.22 | 7.81.0-1ubuntu1.22 |
| haxx | curl | >= 0 < 8.5.0-2ubuntu10.7 | 8.5.0-2ubuntu10.7 |
| haxx | curl | >= 0 < 8.14.1-2ubuntu1.1 | 8.14.1-2ubuntu1.1 |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.20+esm19 | 7.35.0-1ubuntu2.20+esm19 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5LOW
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.3MEDIUM
vendor_msrc4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
curl vulnerabilities
osv·2026-03-03·CVSS 5.3
CVE-2025-14017 [MEDIUM] curl vulnerabilities
curl vulnerabilities
USN-8062-1 fixed vulnerabilities in curl. This update provides the
corresponding update for CVE-2025-14017, CVE-2025-15079, and CVE-2025-15224
for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04
LTS.
Original advisory details:
It was discovered that curl incorrectly handled cookies when redirected
from secure to insecure connections. An attacker could possibly use this
issue to cause a denial of service, or obtain sensitive information.
This issue only affected Ubuntu 25.10. (CVE-2025-9086)
Calvin Ruocco discovered that curl did not properly handle WebSocket
communications under certain circumstances. A malicious server could
possibly use this issue to poison proxy caches with malicious content.
This issue only affected Ubuntu 24.04 LTS and U
OSV
curl vulnerabilities
osv·2026-02-25·CVSS 5.3
CVE-2025-9086 [MEDIUM] curl vulnerabilities
curl vulnerabilities
It was discovered that curl incorrectly handled cookies when redirected
from secure to insecure connections. An attacker could possibly use this
issue to cause a denial of service, or obtain sensitive information.
This issue only affected Ubuntu 25.10. (CVE-2025-9086)
Calvin Ruocco discovered that curl did not properly handle WebSocket
communications under certain circumstances. A malicious server could
possibly use this issue to poison proxy caches with malicious content.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2025-10148)
Stanislav Fort discovered that wcurl did not properly handle URLs with
certain encoded characters. If a user were tricked into processing
a specially crafted URL, an attacker could possibly use this issue to
write files o
OSV
CVE-2025-9086: 1
osv·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: 1
1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (`path=\"/\",`).
Since this site is not secure, the cookie *should* just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer
boundary
The bug either causes a crash or it potentially makes the comparison come to
the wrong conclusion and lets the clear-text site override the contents of the
secure cookie, contrary to expectations and depending on the memory contents
immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly
GHSA
GHSA-v676-f8gm-92r9: 1
ghsa_unreviewed·2025-09-12
CVE-2025-9086 [HIGH] CWE-125 GHSA-v676-f8gm-92r9: 1
1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (`path='/'`).
Since this site is not secure, the cookie *should* just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer
boundary
The bug either causes a crash or it potentially makes the comparison come to
the wrong conclusion and lets the clear-text site override the contents of the
secure cookie, contrary to expectations and depending on the memory contents
immediately following the single-byte allocation that holds the path.
The presumed and correct behavior would be to plainly ig
OSV
CVE-2025-9086: 1
osv·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: 1
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly i
Ubuntu
curl vulnerabilities
vendor_ubuntu·2026-03-03·CVSS 5.3
CVE-2025-15224 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
USN-8062-1 fixed vulnerabilities in curl. This update provides the
corresponding update for CVE-2025-14017, CVE-2025-15079, and CVE-2025-15224
for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04
LTS.
Original advisory details:
It was discovered that curl incorrectly handled cookies when redirected
from secure to insecure connections. An attacker could possibly use this
issue to cause a denial of service, or obtain sensitive information.
This issue only affected Ubuntu 25.10. (CVE-2025-9086)
Calvin Ruocco discovered that curl did not properly handle WebSocket
communications under certain circumstances. A malicious server could
possibly use this issue to poison proxy caches with malic
Ubuntu
curl vulnerabilities
vendor_ubuntu·2026-02-25·CVSS 5.3
CVE-2025-13034 [MEDIUM] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
It was discovered that curl incorrectly handled cookies when redirected
from secure to insecure connections. An attacker could possibly use this
issue to cause a denial of service, or obtain sensitive information.
This issue only affected Ubuntu 25.10. (CVE-2025-9086)
Calvin Ruocco discovered that curl did not properly handle WebSocket
communications under certain circumstances. A malicious server could
possibly use this issue to poison proxy caches with malicious content.
This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10.
(CVE-2025-10148)
Stanislav Fort discovered that wcurl did not properly handle URLs with
certain encoded characters. If a user were tricked into processing
a specially crafted UR
Oracle
Oracle Oracle Commerce Risk Matrix: MDEX, Forge (curl) — CVE-2025-9086
vendor_oracle·2026-01-15·CVSS 7.5
CVE-2025-9086 [HIGH] Oracle Oracle Commerce Risk Matrix: MDEX, Forge (curl) — CVE-2025-9086
Oracle Oracle Commerce Risk Matrix: MDEX, Forge (curl) vulnerability
CVE: CVE-2025-9086
CVSS: 7.5
Protocol: HTTPS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Apple
CVE-2025-9086: iOS 18.7.3 and iPadOS 18.7.3
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: iOS 18.7.3 and iPadOS 18.7.3
Apple Security Update: About the security content of iOS 18.7.3 and iPadOS 18.7.3
Product: iOS 18.7.3 and iPadOS
Version: 18.7.3
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: macOS Sequoia 15.7.3
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: macOS Sequoia 15.7.3
Apple Security Update: About the security content of macOS Sequoia 15.7.3
Product: macOS Sequoia
Version: 15.7.3
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: macOS Tahoe 26.2
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: macOS Tahoe 26.2
Apple Security Update: About the security content of macOS Tahoe 26.2
Product: macOS Tahoe
Version: 26.2
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: iOS 26.2 and iPadOS 26.2
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: iOS 26.2 and iPadOS 26.2
Apple Security Update: About the security content of iOS 26.2 and iPadOS 26.2
Product: iOS 26.2 and iPadOS
Version: 26.2
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: tvOS 26.2
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: tvOS 26.2
Apple Security Update: About the security content of tvOS 26.2
Product: tvOS
Version: 26.2
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: macOS Sonoma 14.8.3
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: macOS Sonoma 14.8.3
Apple Security Update: About the security content of macOS Sonoma 14.8.3
Product: macOS Sonoma
Version: 14.8.3
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: visionOS 26.2
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: visionOS 26.2
Apple Security Update: About the security content of visionOS 26.2
Product: visionOS
Version: 26.2
CVE: CVE-2025-9086
Component: CVE-2025-9086
Apple
CVE-2025-9086: watchOS 26.2
vendor_apple·2025-12-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: watchOS 26.2
Apple Security Update: About the security content of watchOS 26.2
Product: watchOS
Version: 26.2
CVE: CVE-2025-9086
Component: CVE-2025-9086
Oracle
Oracle Oracle Communications Applications Risk Matrix: Security (curl) — CVE-2025-9086
vendor_oracle·2025-10-15·CVSS 7.5
CVE-2025-9086 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Security (curl) — CVE-2025-9086
Oracle Oracle Communications Applications Risk Matrix: Security (curl) vulnerability
CVE: CVE-2025-9086
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Red Hat
curl: libcurl: Curl out of bounds read for cookie path
vendor_redhat·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CWE-125 curl: libcurl: Curl out of bounds read for cookie path
curl: libcurl: Curl out of bounds read for cookie path
1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (`path=\"/\",`).
Since this site is not secure, the cookie *should* just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer
boundary
The bug either causes a crash or it potentially makes the comparison come to
the wrong conclusion and lets the clear-text site override the contents of the
secure cookie, contrary to expectations and depending on the memory contents
immediately following the single-byte allocation that holds the path.
Microsoft
Out of bounds read for cookie path
vendor_msrc·2025-09-09·CVSS 4.3
CVE-2025-9086 [HIGH] Out of bounds read for cookie path
Out of bounds read for cookie path
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
curl: curl
Customer Action Required: Yes
Debian
CVE-2025-9086: curl - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is ...
vendor_debian·2025·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: curl - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is ...
1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path=\"/\",`). Since this site is not secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path. The presumed and correct behavior would be to plainly i
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-9086 curl: libcurl: Curl out of bounds read for cookie path
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 curl: libcurl: Curl out of bounds read for cookie path
CVE-2025-9086 curl: libcurl: Curl out of bounds read for cookie path
1. A cookie is set using the `secure` keyword for `https://target`
2. curl is redirected to or otherwise made to speak with `http://target` (same
hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (`path='/'`).
Since this site is not secure, the cookie *should* just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer
boundary
The bug either causes a crash or it potentially makes the comparison come to
the wrong conclusion and lets the clear-text site override the contents of the
secure cookie, contrary to expectations and depending on the memory contents
immediately following the single-byte allocation that hol
Bugzilla
CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-8]
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-8]
CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-8]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
Hello,
The CVE-2025-9086 vulnerability impacts curl versions 8.13.0 --> 8.15.0.
On EPEL8, Davix embeds libcurl v7.69.0, which is not impacted.
This vulnerability does not impact Davix on EPEL8.
Closing.
Cheers,
Mih
Bugzilla
CVE-2025-9086 davix: Curl out of bounds read for cookie path [fedora-42]
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 davix: Curl out of bounds read for cookie path [fedora-42]
CVE-2025-9086 davix: Curl out of bounds read for cookie path [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from re
Bugzilla
CVE-2025-9086 mingw-curl: Curl out of bounds read for cookie path [fedora-42]
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 mingw-curl: Curl out of bounds read for cookie path [fedora-42]
CVE-2025-9086 mingw-curl: Curl out of bounds read for cookie path [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports fr
Bugzilla
CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-9]
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-9]
CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-9]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
Hello,
The CVE-2025-9086 vulnerability impacts curl versions 8.13.0 --> 8.15.0.
On EPEL9, Davix uses the system-provided curl, with no exact version required.
This vulnerability is not patched at the Davix layer.
Cl
Bugzilla
CVE-2025-9086 rpi-imager: Curl out of bounds read for cookie path [fedora-42]
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 rpi-imager: Curl out of bounds read for cookie path [fedora-42]
CVE-2025-9086 rpi-imager: Curl out of bounds read for cookie path [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports fr
Bugzilla
CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-10]
bugzilla·2025-09-12·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-10]
CVE-2025-9086 davix: Curl out of bounds read for cookie path [epel-10]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
Hello,
The CVE-2025-9086 vulnerability impacts curl versions 8.13.0 --> 8.15.0.
On EPEL10, Davix uses the system-provided curl, with no exact version required.
This vulnerability is not patched at the Davix layer.
HackerOne
CVE-2025-9086: Out of bounds read for cookie path
hackerone·2025-09-10·CVSS 7.5
CVE-2025-9086 [HIGH] CVE-2025-9086: Out of bounds read for cookie path
CVE-2025-9086: Out of bounds read for cookie path
We are tracking this issue with the public ID `BIGSLEEP-437903454`. Please use this identifier for reference in any future communication.
## **Vulnerability Details**
In the cookie support found in `cookie.c`, there's an out-of-bounds string comparison that results from a crafted sequence of cookie operations. When saving a new cookie, we check if it should replace an existing cookie for the same domain. We can see in the snippet below that if the previous cookie path is an empty string `"",` we'll skip over the NUL-terminator at \[0\] and read out-of-bounds when looking for a `/` in the previous cookie path.
```c
static int
replace_existing(struct Curl_easy *data,
struct Cookie *co,
struct CookieInfo *ci,
bool secure,
bool *replacep)
{
https://curl.se/docs/CVE-2025-9086.htmlhttps://curl.se/docs/CVE-2025-9086.jsonhttps://hackerone.com/reports/3294999http://www.openwall.com/lists/oss-security/2025/09/10/1https://lists.debian.org/debian-lts-announce/2026/01/msg00002.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-089022.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-253495.html
2025-09-12
Published