CVE-2022-35252

Name of the Vulnerable Software and Affected Versions cURL versions prior to 7.85.0

Description The issue is related to insufficient input validation when handling cookies with control codes, specifically byte values less than 32. This can be exploited by a remote attacker to cause a denial of service (400 Bad Request error) by sending specially crafted cookie files. The vulnerability effectively allows a "sister site" to deny service to all siblings when curl is used to retrieve and parse cookies from an HTTP(S) server.

Recommendations For versions prior to 7.85.0, update to curl version 7.85.0 to resolve the issue. As a temporary workaround, consider restricting the use of control codes in cookies to minimize the risk of exploitation. Avoid using cookies that contain control codes (byte values below 32) in the affected API endpoints until the issue is resolved.