CVE-2023-46218

Name of the Vulnerable Software and Affected Versions cURL (affected versions not specified)

Description This flaw allows a malicious HTTP server to set "super cookies" in cURL that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in cURL's function that verifies a given cookie domain against the Public Suffix List (PSL). For example, a cookie could be set with domain=co.UK when the URL used a lower case hostname curl.co.uk, even though co.uk is listed as a PSL domain.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.