CVE-2026-82209 - domain-scoped PSL domain cookie
Brief
CVE ID : CVE-2026-82209
Published : Sept. 6, 2026, 6:17 p. m.
- 2 hours, 31 minutes ago
Description : When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e. g. , `Domain=co. uk` set by `co. uk`).
Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`. co. uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e. g. , `attacker. co. uk`).
Severity: 0.0
- NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...