Executive brief
curl is a widely used open-source library for transferring data via HTTP and other protocols, embedded in countless applications and command-line tools. When libpsl (Public Suffix List) support is enabled, curl incorrectly processes cookies set on public suffix domains (like co.uk), storing them with wildcard scope instead of restricting them to the origin host. This allows attackers who control a sibling subdomain under the same public suffix to receive cookies intended for other domains, potentially leading to session hijacking or unauthorized access to user data.
Technical details
This is an information disclosure vulnerability (CWE-201) in curl's cookie handling when libpsl support is enabled. The root cause is a missing or incorrect Public Suffix List boundary check in the Set-Cookie processing logic. When a server at a public suffix domain (e.g., co.uk) sets a cookie with Domain=co.uk, curl should coerce it into a host-only cookie but instead saves it with wildcard domain scope (.co.uk). An attacker who controls a sibling subdomain (attacker.co.uk) can then receive the cookie in subsequent requests. This requires no authentication or special network position—only that the legitimate user connects to both an affected domain and the attacker's sibling domain. Patches are available in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 or later.
Affected products
- curl curl 7.46.0 to 8.21.0 (with exceptions: 8.14.2+, 8.16.1+, 8.20.1+, 8.22.0+)
Timeline
- 2026-09-02: disclosed: Coordinated publication with curl 8.22.0 release
- 2026-09-02: patched: Fixed in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0