This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-minimalUpgrade libcurlUpgrade curl-minimalUpgrade curlUpgrade libcurl-devel | Mar 8, 2024 | Dec 7, 2023 |
| Alpine Linux | — | Upgrade curl | Mar 26, 2024 | Dec 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libcurlUpgrade curl-debuginfoUpgrade curlUpgrade libcurl-devel | Jan 10, 2024 | Dec 7, 2023 |
| Amazon_linux_2023 | — | Upgrade libcurl-develUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curl-minimalUpgrade curl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimal-debuginfoUpgrade curlUpgrade curl-minimal-debuginfoUpgrade libcurl-minimal | Feb 17, 2025 | Dec 6, 2023 |
| Debian | — | Upgrade curl | Dec 27, 2023 | Dec 7, 2023 |
| F5 Big Ip | — | — | Mar 7, 2024 | Dec 7, 2023 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade curlUpgrade libcurl | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Jan 29, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Feb 12, 2024 | Dec 7, 2023 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory4 | Mar 8, 2024 | Dec 7, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 10, 2024 |
| Oracle_linux | — | Upgrade curl-minimalUpgrade libcurl-develUpgrade curlUpgrade libcurl-minimalUpgrade libcurl | Mar 7, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade curl-minimal-debuginfoUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade libcurl-develUpgrade curl-debuginfoUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade libcurlUpgrade curl | Jan 26, 2024 | Dec 7, 2023 |
| Rocky_linux | — | Upgrade libcurlUpgrade libcurl-minimal-debuginfoUpgrade curlUpgrade libcurl-develUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade curl-debuginfo | Apr 8, 2024 | Dec 7, 2023 |
| Suse | — | Upgrade libcurl-devel-32bitUpgrade libcurl4-32bitUpgrade curlUpgrade libcurl-develUpgrade libcurl4 | Dec 7, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-nssUpgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curlUpgrade libcurl4 (Ubuntu Pro)Upgrade libcurl4Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3-gnutls | Dec 8, 2023 | Dec 7, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub