curl / Docs / curl CVEs / domain-scoped PSL domain cookie
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-82209

domain-scoped PSL domain cookie

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., attacker.co.uk).

INFO

An attacker cannot plant this cookie - exploitation requires the apex to issue such a cookie and the curl client to subsequently contact the attacker sibling.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-82209 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS

This bug has existed in curl since it first started to support cookies, but I decided to rather count from the time PSL was supported and supposed to do this correctly.

libcurl is used by many applications, but not always advertised as such!

This flaw is also accessible using the curl command line tool.

SOLUTION

RECOMMENDATIONS

A - Upgrade curl to version 8.22.0

B - Apply the patch to your local version

C - Do not use cookies

TIMELINE

This issue was reported to the curl project on August 26, 2026.

curl 8.22.0 was released on September 2, 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!