Tools AI-Found Vulnerability Register aifv-0016
Register entry
curl out-of-bounds read in cookie path handling, found by Google Big Sleep
- CVE
- CVE-2025-9086
- Project
- curl
- Component
- cookie path
- Finder
- Google Big Sleep
- Autonomy
- agent finds and reproduces; a human expert reviews before reporting
- Evidence tier
- Credits array names the finder
- Assigner
- curl
- Severity
- Low
- Bounty
- Awarded 505 (curl via HackerOne, report 3294999; award published in curl’s advisory)
- Confidence
- CONFIRMED
What happened
An out-of-bounds read in cookie-path handling affecting curl 8.13.0 to 8.15.0. curl’s advisory, published on 10 September 2025, credits Google Big Sleep, rates the issue Low and records a $505 award. curl 8.16.0 contains the fix.
Credit as recorded: finder: "Google Big Sleep"; remediation developer: Daniel Stenberg. The attacker needs control of the HTTP site sharing the HTTPS target’s hostname, or a position to intercept its traffic. The flaw can cause a crash or an incorrect cookie comparison, depending on adjacent heap contents. The CVE record was published on 12 September; the row uses the advisory’s earlier publication date. The maintainer records the award; payment settlement is unspecified. Date basis: vendor advisory publication.
Sources
- CVE record, cvelistV5 mirrorraw.githubusercontent.com/CVEProject/cvelistV5/main/cves/202…
- curl advisory, fixed version and $505 awardcurl.se/docs/CVE-2025-9086.html
On YFarmX
- Reference pageyfarmx.com/ai/security/big-sleep/
One record from the AI-Found Vulnerability Register, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 8 October 2026