# CVE-2026-82209: curl Public Suffix List domain boundary check bypass in cookie handling

Source: https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-82209 · Severity: high · CVSS 8.2 · Published 2026-09-06

curl is a widely used open-source library for transferring data via HTTP and other protocols, embedded in countless applications and command-line tools. When libpsl (Public Suffix List) support is enabled, curl incorrectly processes cookies set on public suffix domains (like co.uk), storing them with wildcard scope instead of restricting them to the origin host. This allows attackers who control a sibling subdomain under the same public suffix to receive cookies intended for other domains, potentially leading to session hijacking or unauthorized access to user data.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-82209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82209 being exploited in the wild.

**How severe is CVE-2026-82209?** High severity, with a CVSS score of 8.2, published 6 September 2026.

**Which products and versions are affected?** curl curl 7.46.0 to 8.21.0 (with exceptions: 8.14.2+, 8.16.1+, 8.20.1+, 8.22.0+).

**Is there a fix for CVE-2026-82209?** A patch was published on 2026-09-02: Fixed in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82209?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an information disclosure vulnerability (CWE-201) in curl's cookie handling when libpsl support is enabled. The root cause is a missing or incorrect Public Suffix List boundary check in the Set-Cookie processing logic. When a server at a public suffix domain (e.g., co.uk) sets a cookie with Domain=co.uk, curl should coerce it into a host-only cookie but instead saves it with wildcard domain scope (.co.uk). An attacker who controls a sibling subdomain (attacker.co.uk) can then receive the cookie in subsequent requests. This requires no authentication or special network position—only that the legitimate user connects to both an affected domain and the attacker's sibling domain. Patches are available in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0 or later.

## Affected products

- curl curl 7.46.0 to 8.21.0 (with exceptions: 8.14.2+, 8.16.1+, 8.20.1+, 8.22.0+)

## Timeline

- 2026-09-02: disclosed: Coordinated publication with curl 8.22.0 release
- 2026-09-02: patched: Fixed in curl versions 8.14.2, 8.16.1, 8.20.1, and 8.22.0

## References

- [https://curl.se/docs/CVE-2026-82209.html](https://curl.se/docs/CVE-2026-82209.html)
- [https://curl.se/docs/CVE-2026-82209.json](https://curl.se/docs/CVE-2026-82209.json)

## Related threats

- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl secure cookie attribute bypass with tab](https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)
- [curl OpenSSL provider use-after-free in TLS connections](https://junglewise.ai/threats/cve-2026-80229-curl-openssl-provider-use-after-free-in-tls-connections)