CVE-2026-82209
8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Summary
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| curl | curl | 7.46.0 < 8.14.2 | affected |
| curl | curl | 8.15.0 < 8.16.1 | affected |
| curl | curl | 8.17.0 < 8.20.1 | affected |
| curl | curl | 8.21.0 < 8.22.0 | affected |
| curl | curl | e77b5b7453c1e8ccd7ec0816890d98e2f392e465 < 95c1e8915dce64606bd753fd47fc0bd236e31cd6 | affected |
| curl | curl | 8.21.0 | affected |
| curl | curl | 8.20.0 | affected |
| curl | curl | 8.19.0 | affected |
| curl | curl | 8.18.0 | affected |
| curl | curl | 8.17.0 | affected |
| curl | curl | 8.16.0 | affected |
| curl | curl | 8.15.0 | affected |
| curl | curl | 8.14.1 | affected |
| curl | curl | 8.14.0 | affected |
| curl | curl | 8.13.0 | affected |
| curl | curl | 8.12.1 | affected |
| curl | curl | 8.12.0 | affected |
| curl | curl | 8.11.1 | affected |
| curl | curl | 8.11.0 | affected |
| curl | curl | 8.10.1 | affected |
| curl | curl | 8.10.0 | affected |
| curl | curl | 8.9.1 | affected |
| curl | curl | 8.9.0 | affected |
| curl | curl | 8.8.0 | affected |
| curl | curl | 8.7.1 | affected |
| curl | curl | 8.7.0 | affected |
| curl | curl | 8.6.0 | affected |
| curl | curl | 8.5.0 | affected |
| curl | curl | 8.4.0 | affected |
| curl | curl | 8.3.0 | affected |
| curl | curl | 8.2.1 | affected |
| curl | curl | 8.2.0 | affected |
| curl | curl | 8.1.2 | affected |
| curl | curl | 8.1.1 | affected |
| curl | curl | 8.1.0 | affected |
| curl | curl | 8.0.1 | affected |
| curl | curl | 8.0.0 | affected |
| curl | curl | 7.88.1 | affected |
| curl | curl | 7.88.0 | affected |
| curl | curl | 7.87.0 | affected |
| curl | curl | 7.86.0 | affected |
| curl | curl | 7.85.0 | affected |
| curl | curl | 7.84.0 | affected |
| curl | curl | 7.83.1 | affected |
| curl | curl | 7.83.0 | affected |
| curl | curl | 7.82.0 | affected |
| curl | curl | 7.81.0 | affected |
| curl | curl | 7.80.0 | affected |
| curl | curl | 7.79.1 | affected |
| curl | curl | 7.79.0 | affected |
| curl | curl | 7.78.0 | affected |
| curl | curl | 7.77.0 | affected |
| curl | curl | 7.76.1 | affected |
| curl | curl | 7.76.0 | affected |
| curl | curl | 7.75.0 | affected |
| curl | curl | 7.74.0 | affected |
| curl | curl | 7.73.0 | affected |
| curl | curl | 7.72.0 | affected |
| curl | curl | 7.71.1 | affected |
| curl | curl | 7.71.0 | affected |
| curl | curl | 7.70.0 | affected |
| curl | curl | 7.69.1 | affected |
| curl | curl | 7.69.0 | affected |
| curl | curl | 7.68.0 | affected |
| curl | curl | 7.67.0 | affected |
| curl | curl | 7.66.0 | affected |
| curl | curl | 7.65.3 | affected |
| curl | curl | 7.65.2 | affected |
| curl | curl | 7.65.1 | affected |
| curl | curl | 7.65.0 | affected |
| curl | curl | 7.64.1 | affected |
| curl | curl | 7.64.0 | affected |
| curl | curl | 7.63.0 | affected |
| curl | curl | 7.62.0 | affected |
| curl | curl | 7.61.1 | affected |
| curl | curl | 7.61.0 | affected |
| curl | curl | 7.60.0 | affected |
| curl | curl | 7.59.0 | affected |
| curl | curl | 7.58.0 | affected |
| curl | curl | 7.57.0 | affected |
| curl | curl | 7.56.1 | affected |
| curl | curl | 7.56.0 | affected |
| curl | curl | 7.55.1 | affected |
| curl | curl | 7.55.0 | affected |
| curl | curl | 7.54.1 | affected |
| curl | curl | 7.54.0 | affected |
| curl | curl | 7.53.1 | affected |
| curl | curl | 7.53.0 | affected |
| curl | curl | 7.52.1 | affected |
| curl | curl | 7.52.0 | affected |
| curl | curl | 7.51.0 | affected |
| curl | curl | 7.50.3 | affected |
| curl | curl | 7.50.2 | affected |
| curl | curl | 7.50.1 | affected |
| curl | curl | 7.50.0 | affected |
| curl | curl | 7.49.1 | affected |
| curl | curl | 7.49.0 | affected |
| curl | curl | 7.48.0 | affected |
| curl | curl | 7.47.1 | affected |
| curl | curl | 7.47.0 | affected |
| curl | curl | 7.46.0 | affected |
Weaknesses
- CWE-201: Information Exposure Through Sent Data
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: yes
- Technical Impact: partial
Additional References
References
- https://curl.se/docs/CVE-2026-82209.json
- https://curl.se/docs/CVE-2026-82209.html
- https://hackerone.com/reports/3972385
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.