A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libcurlUpgrade libcurl-develUpgrade curlUpgrade libcurl-minimalUpgrade curl-minimal | Oct 12, 2026 | Oct 12, 2026 |
| Alpine Linux | — | Upgrade curl | Jul 6, 2026 | Jul 3, 2026 |
| Amazon_linux_2023 | — | Upgrade libcurl-minimal-debuginfoUpgrade curlUpgrade curl-debuginfoUpgrade libcurl-minimalUpgrade curl-minimalUpgrade libcurl-develUpgrade curl-debugsourceUpgrade libcurlUpgrade curl-minimal-debuginfoUpgrade libcurl-debuginfo | Sep 30, 2026 | Jul 3, 2026 |
| Debian | — | Upgrade curl | Oct 15, 2026 | Jul 3, 2026 |
| Ibm Aix | — | Apply the fix or workaround for curl_advisory11 | Jul 28, 2026 | Jul 28, 2026 |
| Redhat_linux | — | No solution existsUpgrade curl-debuginfoUpgrade libcurl-debuginfoUpgrade curl-minimalUpgrade libcurlUpgrade curlUpgrade libcurl-minimal-debuginfoUpgrade curl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-develUpgrade libcurl-minimal | Jul 17, 2026 | Jul 3, 2026 |
| Rocky_linux | — | Upgrade curl-minimal-debuginfoUpgrade curl-debugsourceUpgrade libcurl-debuginfoUpgrade libcurl-develUpgrade libcurl-minimal-debuginfoUpgrade curlUpgrade libcurlUpgrade curl-minimalUpgrade libcurl-minimalUpgrade curl-debuginfo | Sep 28, 2026 | Sep 22, 2026 |
| Ubuntu | — | Upgrade libcurl4-openssl-dev (Ubuntu Pro)Upgrade libcurl4-gnutls-devUpgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro)Upgrade libcurl4-gnutls-dev (Ubuntu Pro)Upgrade libcurl4Upgrade libcurl3-nssUpgrade curl (Ubuntu Pro)Upgrade libcurl4-nss-devUpgrade libcurl4t64Upgrade curlUpgrade libcurl3t64-gnutlsUpgrade libcurl4-openssl-devUpgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3 (Ubuntu Pro)Upgrade libcurl4-nss-dev (Ubuntu Pro)Upgrade libcurl3-gnutls | Jul 1, 2026 | Jun 30, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 10, 2026 | Jul 3, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub