This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurl-minimalUpgrade libcurlUpgrade curl-minimalUpgrade libcurl-develUpgrade curl | Mar 8, 2024 | Dec 7, 2023 |
| Alpine Linux | — | Upgrade curl | Mar 26, 2024 | Dec 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade libcurl-develUpgrade curlUpgrade curl-debuginfoUpgrade libcurl | Jan 10, 2024 | Dec 7, 2023 |
| Amazon_linux_2023 | — | Upgrade curl-minimal-debuginfoUpgrade curlUpgrade libcurl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade libcurl-debuginfoUpgrade libcurlUpgrade curl-debuginfoUpgrade curl-minimalUpgrade libcurl-devel | Feb 17, 2025 | Dec 6, 2023 |
| Debian | — | Upgrade curl | Dec 27, 2023 | Dec 7, 2023 |
| F5 Big Ip | — | — | Mar 7, 2024 | Dec 7, 2023 |
| Gentoo Linux | — | Upgrade net-misc/curl. | Sep 24, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Jan 29, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libcurlUpgrade curlUpgrade libcurl-devel | Mar 13, 2024 | Dec 7, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Feb 12, 2024 | Dec 7, 2023 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory4 | Mar 8, 2024 | Dec 7, 2023 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Sep 10, 2024 |
| Oracle_linux | — | Upgrade curlUpgrade libcurl-develUpgrade curl-minimalUpgrade libcurlUpgrade libcurl-minimal | Mar 7, 2024 | Dec 6, 2023 |
| Redhat_linux | — | Upgrade libcurl-develUpgrade libcurl-debuginfoUpgrade curlUpgrade curl-debuginfoUpgrade curl-minimalUpgrade libcurlUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfo | Jan 26, 2024 | Dec 7, 2023 |
| Rocky_linux | — | Upgrade libcurl-minimal-debuginfoUpgrade curlUpgrade libcurlUpgrade libcurl-develUpgrade libcurl-debuginfoUpgrade curl-debugsourceUpgrade libcurl-minimalUpgrade curl-debuginfo | Apr 8, 2024 | Dec 7, 2023 |
| Suse | — | Upgrade libcurl4Upgrade curlUpgrade libcurl-develUpgrade libcurl4-32bitUpgrade libcurl-devel-32bit | Dec 7, 2023 | Dec 6, 2023 |
| Ubuntu | — | Upgrade libcurl3-nssUpgrade libcurl3-gnutls (Ubuntu Pro)Upgrade curl (Ubuntu Pro)Upgrade libcurl3-nss (Ubuntu Pro)Upgrade curlUpgrade libcurl3-gnutlsUpgrade libcurl4 (Ubuntu Pro)Upgrade libcurl4Upgrade libcurl3 (Ubuntu Pro) | Dec 8, 2023 | Dec 7, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub