This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-develUpgrade curlUpgrade curl-minimalUpgrade libcurl-minimalUpgrade libcurl | Mar 8, 2024 | Dec 7, 2023 |
| Alpine Linux | — | Upgrade curl | Mar 26, 2024 | Dec 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade curlUpgrade libcurl-develUpgrade libcurlUpgrade curl-debuginfo | Jan 10, 2024 | Dec 7, 2023 |
| Amazon_linux_2023 | — | Upgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curlUpgrade libcurl-minimalUpgrade curl-debugsourceUpgrade libcurlUpgrade libcurl-develUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade curl-debuginfo | Feb 17, 2025 | Dec 6, 2023 |
| Debian | — | Upgrade curl | Dec 27, 2023 | Dec 7, 2023 |
| F5 Big Ip | — | — | Mar 7, 2024 | Dec 7, 2023 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libcurlUpgrade curl | Jan 29, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade curlUpgrade libcurlUpgrade libcurl-devel | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Feb 12, 2024 | Dec 7, 2023 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory4 | Mar 8, 2024 | Dec 7, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 10, 2024 |
| Oracle_linux | — | Upgrade curlUpgrade libcurl-develUpgrade curl-minimalUpgrade libcurl-minimalUpgrade libcurl | Mar 7, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade libcurlUpgrade curl-minimalUpgrade curlUpgrade libcurl-debuginfoUpgrade libcurl-develUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimal-debuginfoUpgrade libcurl-minimalUpgrade curl-minimal-debuginfo | Jan 26, 2024 | Dec 7, 2023 |
| Rocky_linux | — | Upgrade curlUpgrade libcurl-minimal-debuginfoUpgrade libcurl-develUpgrade libcurlUpgrade curl-debuginfoUpgrade libcurl-minimalUpgrade libcurl-debuginfoUpgrade curl-debugsource | Apr 8, 2024 | Dec 7, 2023 |
| Suse | — | Upgrade libcurl4Upgrade curlUpgrade libcurl-develUpgrade libcurl-devel-32bitUpgrade libcurl4-32bit | Dec 7, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade curlUpgrade libcurl4Upgrade libcurl3-nssUpgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curl (Ubuntu Pro) | Dec 8, 2023 | Dec 7, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub