diff --git a/0041-curl-7.76.1-CVE-2025-9086.patch b/0041-curl-7.76.1-CVE-2025-9086.patch
new file mode 100644
index 0000000..a49f121
--- /dev/null
+++ b/0041-curl-7.76.1-CVE-2025-9086.patch
@@ -0,0 +1,48 @@
+From c6ae07c6a541e0e96d0040afb62b45dd37711300 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Mon, 11 Aug 2025 20:23:05 +0200
+Subject: [PATCH] cookie: don't treat the leading slash as trailing
+
+If there is only a leading slash in the path, keep that. Also add an
+assert to make sure the path is never blank.
+
+Reported-by: Google Big Sleep
+Closes #18266
+---
+ lib/cookie.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 914a4aca12ac..b72dd99bce9b 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -296,7 +296,7 @@ static char *sanitize_cookie_path(const char *cookie_path)
+   }
+ 
+   /* convert /hoge/ to /hoge */
+-  if(len && new_path[len - 1] == '/') {
++  if(len > 1 && new_path[len - 1] == '/') {
+     new_path[len - 1] = 0x0;
+   }
+ 
+@@ -965,7 +965,7 @@ replace_existing(struct Curl_easy *data,
+         if(clist->spath && co->spath) {
+           if(clist->secure && !co->secure && !secure) {
+             size_t cllen;
+-            const char *sep;
++            const char *sep = NULL;
+ 
+             /*
+              * A non-secure cookie may not overlay an existing secure cookie.
+@@ -974,8 +974,9 @@ replace_existing(struct Curl_easy *data,
+              * "/loginhelper" is ok.
+              */
+ 
+-            sep = strchr(clist->spath + 1, '/');
+-
++            DEBUGASSERT(clist->spath[0]);
++            if(clist->spath[0])
++              sep = strchr(clist->spath + 1, '/');
+             if(sep)
+               cllen = sep - clist->spath;
+             else
diff --git a/curl.spec b/curl.spec
index f833bc0..7985727 100644
--- a/curl.spec
+++ b/curl.spec
@@ -1,7 +1,7 @@
 Summary: A utility for getting files from remote servers (FTP, HTTP, and others)
 Name: curl
 Version: 7.76.1
-Release: 34%{?dist}
+Release: 35%{?dist}
 License: MIT
 Source: https://curl.se/download/%{name}-%{version}.tar.xz
 
@@ -122,6 +122,9 @@ Patch39:  0039-curl-7.76.1-pause-on-http.patch
 # noproxy: support proxies specified using cidr notation
 Patch40:  0040-curl-7.76.1-noproxy-support-using-cidr.patch
 
+# cookie: don't treat the leading slash as trailing (CVE-2025-9086)
+Patch041: 0041-curl-7.76.1-CVE-2025-9086.patch
+
 # patch making libcurl multilib ready
 Patch101: 0101-curl-7.32.0-multilib.patch
 
@@ -336,6 +339,7 @@ be installed.
 %patch -P 38 -p1
 %patch -P 39 -p1
 %patch -P 40 -p1
+%patch -P 41 -p1
 
 # Fedora patches
 %patch -P 101 -p1
@@ -561,7 +565,11 @@ rm -f ${RPM_BUILD_ROOT}%{_libdir}/libcurl.la
 %{_libdir}/libcurl.so.4.[0-9].[0-9].minimal
 
 %changelog
-* Mon Jul 23 2025 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-34
+* Thu Oct 23 2025 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-35
+- cookie: don't treat the leading slash as trailing (CVE-2025-9086)
+  Resolves: RHEL-121659
+
+* Wed Jul 23 2025 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-34
 - revert several disabled tests related to openssl/valgrind (RHEL-99465)
 
 * Thu May 15 2025 Jacek Migacz <jmigacz@redhat.com> - 7.76.1-33