Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-82209

domain-scoped PSL domain cookie

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
curl

Description

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

curl curl

Default version status: unaffected

  • 7.46.0 to < 8.14.2affected
  • 8.15.0 to < 8.16.1affected
  • 8.17.0 to < 8.20.1affected
  • 8.21.0 to < 8.22.0affected

curl curl

Default version status: unaffected

  • e77b5b7453c1e8ccd7ec0816890d98e2f392e465 to < 95c1e8915dce64606bd753fd47fc0bd236e31cd6affected

curl curl

Default version status: unaffected

  • 8.21.0affected
  • 8.20.0affected
  • 8.19.0affected
  • 8.18.0affected
  • 8.17.0affected
  • 8.16.0affected
  • 8.15.0affected
  • 8.14.1affected
  • 8.14.0affected
  • 8.13.0affected
  • 8.12.1affected
  • 8.12.0affected
  • 8.11.1affected
  • 8.11.0affected
  • 8.10.1affected
  • 8.10.0affected
  • 8.9.1affected
  • 8.9.0affected
  • 8.8.0affected
  • 8.7.1affected
  • 8.7.0affected
  • 8.6.0affected
  • 8.5.0affected
  • 8.4.0affected
  • 8.3.0affected
  • 8.2.1affected
  • 8.2.0affected
  • 8.1.2affected
  • 8.1.1affected
  • 8.1.0affected
  • 8.0.1affected
  • 8.0.0affected
  • 7.88.1affected
  • 7.88.0affected
  • 7.87.0affected
  • 7.86.0affected
  • 7.85.0affected
  • 7.84.0affected
  • 7.83.1affected
  • 7.83.0affected
  • 7.82.0affected
  • 7.81.0affected
  • 7.80.0affected
  • 7.79.1affected
  • 7.79.0affected
  • 7.78.0affected
  • 7.77.0affected
  • 7.76.1affected
  • 7.76.0affected
  • 7.75.0affected
  • 7.74.0affected
  • 7.73.0affected
  • 7.72.0affected
  • 7.71.1affected
  • 7.71.0affected
  • 7.70.0affected
  • 7.69.1affected
  • 7.69.0affected
  • 7.68.0affected
  • 7.67.0affected
  • 7.66.0affected
  • 7.65.3affected
  • 7.65.2affected
  • 7.65.1affected
  • 7.65.0affected
  • 7.64.1affected
  • 7.64.0affected
  • 7.63.0affected
  • 7.62.0affected
  • 7.61.1affected
  • 7.61.0affected
  • 7.60.0affected
  • 7.59.0affected
  • 7.58.0affected
  • 7.57.0affected
  • 7.56.1affected
  • 7.56.0affected
  • 7.55.1affected
  • 7.55.0affected
  • 7.54.1affected
  • 7.54.0affected
  • 7.53.1affected
  • 7.53.0affected
  • 7.52.1affected
  • 7.52.0affected
  • 7.51.0affected
  • 7.50.3affected
  • 7.50.2affected
  • 7.50.1affected
  • 7.50.0affected
  • 7.49.1affected
  • 7.49.0affected
  • 7.48.0affected
  • 7.47.1affected
  • 7.47.0affected
  • 7.46.0affected

References