Is CVE-2026-82209 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82209 being exploited in the wild.

How severe is CVE-2026-82209?

High severity, with a CVSS score of 8.2, published 6 September 2026.

Which products and versions are affected?

curl curl 7.46.0 to 8.21.0 (with exceptions: 8.14.2+, 8.16.1+, 8.20.1+, 8.22.0+).

Is there a fix for CVE-2026-82209?

A patch was published on 2026-09-02: Fixed in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82209 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82209?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82209: curl Public Suffix List domain boundary check bypass in cookie handling

CVE-2026-82209 · Severity: high · CVSS 8.2 · Published 2026-09-06

curl is a widely used open-source library for transferring data via HTTP and other protocols, embedded in countless applications and command-line tools. When libpsl (Public Suffix List) support is enabled, curl incorrectly processes cookies set on public suffix domains (like co.uk), storing them with wildcard scope instead of restricting them to the origin host. This allows attackers who control a sibling subdomain under the same public suffix to receive cookies intended for other domains, potentially leading to session hijacking or unauthorized access to user data.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-82209 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82209 being exploited in the wild.
How severe is CVE-2026-82209?: High severity, with a CVSS score of 8.2, published 6 September 2026.
Which products and versions are affected?: curl curl 7.46.0 to 8.21.0 (with exceptions: 8.14.2+, 8.16.1+, 8.20.1+, 8.22.0+).
Is there a fix for CVE-2026-82209?: A patch was published on 2026-09-02: Fixed in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82209 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82209?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an information disclosure vulnerability (CWE-201) in curl's cookie handling when libpsl support is enabled. The root cause is a missing or incorrect Public Suffix List boundary check in the Set-Cookie processing logic. When a server at a public suffix domain (e.g., co.uk) sets a cookie with Domain=co.uk, curl should coerce it into a host-only cookie but instead saves it with wildcard domain scope (.co.uk). An attacker who controls a sibling subdomain (attacker.co.uk) can then receive the cookie in subsequent requests. This requires no authentication or special network position—only that the legitimate user connects to both an affected domain and the attacker's sibling domain. Patches are available in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 or later.

Affected products

curl curl 7.46.0 to 8.21.0 (with exceptions: 8.14.2+, 8.16.1+, 8.20.1+, 8.22.0+)

Timeline

2026-09-02: disclosed: Coordinated publication with curl 8.22.0 release
2026-09-02: patched: Fixed in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.