CVE-2026-82209

EUVD-2026-72153

06.09.2026, 18:17

When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a `Set-Cookie` header where the `Domain`
attribute explicitly matches an origin host that is itself a public suffix
(e.g., `Domain=co.uk` set by `co.uk`).

Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
`attacker.co.uk`).

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
curl	CNA	8.2 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 29.66%

Affected Products (NVD)

Vendor	Product	Version
haxx	curl	7.46.0 ≤ 𝑥 < 8.22.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
curl	curl	7.46.0 ≤ 𝑥 < 8.14.2	CNA
curl	curl	8.15.0 ≤ 𝑥 < 8.16.1	CNA
curl	curl	8.17.0 ≤ 𝑥 < 8.20.1	CNA
curl	curl	8.21.0 ≤ 𝑥 < 8.22.0	CNA
curl	curl	8.21.0	CNA
curl	curl	8.20.0	CNA
curl	curl	8.19.0	CNA
curl	curl	8.18.0	CNA
curl	curl	8.17.0	CNA
curl	curl	8.16.0	CNA
curl	curl	8.15.0	CNA
curl	curl	8.14.1	CNA
curl	curl	8.14.0	CNA
curl	curl	8.13.0	CNA
curl	curl	8.12.1	CNA
curl	curl	8.12.0	CNA
curl	curl	8.11.1	CNA
curl	curl	8.11.0	CNA
curl	curl	8.10.1	CNA
curl	curl	8.10.0	CNA
curl	curl	8.9.1	CNA
curl	curl	8.9.0	CNA
curl	curl	8.8.0	CNA
curl	curl	8.7.1	CNA
curl	curl	8.7.0	CNA
curl	curl	8.6.0	CNA
curl	curl	8.5.0	CNA
curl	curl	8.4.0	CNA
curl	curl	8.3.0	CNA
curl	curl	8.2.1	CNA
curl	curl	8.2.0	CNA
curl	curl	8.1.2	CNA
curl	curl	8.1.1	CNA
curl	curl	8.1.0	CNA
curl	curl	8.0.1	CNA
curl	curl	8.0.0	CNA
curl	curl	7.88.1	CNA
curl	curl	7.88.0	CNA
curl	curl	7.87.0	CNA
curl	curl	7.86.0	CNA
curl	curl	7.85.0	CNA
curl	curl	7.84.0	CNA
curl	curl	7.83.1	CNA
curl	curl	7.83.0	CNA
curl	curl	7.82.0	CNA
curl	curl	7.81.0	CNA
curl	curl	7.80.0	CNA
curl	curl	7.79.1	CNA
curl	curl	7.79.0	CNA
curl	curl	7.78.0	CNA
curl	curl	7.77.0	CNA
curl	curl	7.76.1	CNA
curl	curl	7.76.0	CNA
curl	curl	7.75.0	CNA
curl	curl	7.74.0	CNA
curl	curl	7.73.0	CNA
curl	curl	7.72.0	CNA
curl	curl	7.71.1	CNA
curl	curl	7.71.0	CNA
curl	curl	7.70.0	CNA
curl	curl	7.69.1	CNA
curl	curl	7.69.0	CNA
curl	curl	7.68.0	CNA
curl	curl	7.67.0	CNA
curl	curl	7.66.0	CNA
curl	curl	7.65.3	CNA
curl	curl	7.65.2	CNA
curl	curl	7.65.1	CNA
curl	curl	7.65.0	CNA
curl	curl	7.64.1	CNA
curl	curl	7.64.0	CNA
curl	curl	7.63.0	CNA
curl	curl	7.62.0	CNA
curl	curl	7.61.1	CNA
curl	curl	7.61.0	CNA
curl	curl	7.60.0	CNA
curl	curl	7.59.0	CNA
curl	curl	7.58.0	CNA
curl	curl	7.57.0	CNA
curl	curl	7.56.1	CNA
curl	curl	7.56.0	CNA
curl	curl	7.55.1	CNA
curl	curl	7.55.0	CNA
curl	curl	7.54.1	CNA
curl	curl	7.54.0	CNA
curl	curl	7.53.1	CNA
curl	curl	7.53.0	CNA
curl	curl	7.52.1	CNA
curl	curl	7.52.0	CNA
curl	curl	7.51.0	CNA
curl	curl	7.50.3	CNA
curl	curl	7.50.2	CNA
curl	curl	7.50.1	CNA
curl	curl	7.50.0	CNA
curl	curl	7.49.1	CNA
curl	curl	7.49.0	CNA
curl	curl	7.48.0	CNA
curl	curl	7.47.1	CNA
curl	curl	7.47.0	CNA
curl	curl	7.46.0	CNA

Debian Releases

Debian Product

Codename

curl

bookworm	postponed
bookworm (security)	vulnerable
forky	8.22.0-1 fixed
sid	8.23.0~rc3-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

curl

bionic	Fixed 7.58.0-2ubuntu3.24+esm14 released
focal	Fixed 7.68.0-1ubuntu2.25+esm9 released
jammy	Fixed 7.81.0-1ubuntu1.29 released
noble	Fixed 8.5.0-2ubuntu10.15 released
resolute	Fixed 8.18.0-1ubuntu2.7 released
trusty	not-affected
xenial	not-affected

Known Exploits!

Common Weakness Enumeration

CWE-201 - Insertion of Sensitive Information Into Sent Data
The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References

https://curl.se/docs/CVE-2026-82209.html

https://curl.se/docs/CVE-2026-82209.json

https://hackerone.com/reports/3972385