This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-develUpgrade curl-minimalUpgrade curlUpgrade libcurl-minimalUpgrade libcurl | Mar 8, 2024 | Dec 7, 2023 |
| Alpine Linux | — | Upgrade curl | Mar 26, 2024 | Dec 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade curl-debuginfoUpgrade curlUpgrade libcurl | Jan 10, 2024 | Dec 7, 2023 |
| Amazon_linux_2023 | — | Upgrade libcurl-develUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curl-debuginfoUpgrade curl-minimalUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfoUpgrade curl-debugsourceUpgrade curl | Feb 17, 2025 | Dec 6, 2023 |
| Debian | — | Upgrade curl | Dec 27, 2023 | Dec 7, 2023 |
| F5 Big Ip | — | — | Mar 7, 2024 | Dec 7, 2023 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libcurlUpgrade curl | Jan 29, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade libcurlUpgrade curl | Feb 12, 2024 | Dec 7, 2023 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory4 | Mar 8, 2024 | Dec 7, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 10, 2024 |
| Oracle_linux | — | Upgrade curlUpgrade libcurl-develUpgrade curl-minimalUpgrade libcurlUpgrade libcurl-minimal | Mar 7, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade curl-debuginfoUpgrade libcurlUpgrade curlUpgrade libcurl-develUpgrade curl-minimalUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade curl-minimal-debuginfoUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfo | Jan 26, 2024 | Dec 7, 2023 |
| Rocky_linux | — | Upgrade libcurl-develUpgrade curlUpgrade libcurl-minimal-debuginfoUpgrade libcurlUpgrade libcurl-minimalUpgrade curl-debugsourceUpgrade libcurl-debuginfoUpgrade curl-debuginfo | Apr 8, 2024 | Dec 7, 2023 |
| Suse | — | Upgrade libcurl4Upgrade curlUpgrade libcurl-develUpgrade libcurl-devel-32bitUpgrade libcurl4-32bit | Dec 7, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade libcurl3 (Ubuntu Pro)Upgrade curlUpgrade libcurl4Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curl (Ubuntu Pro) | Dec 8, 2023 | Dec 7, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub