CVE-2026-82209

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description When libpsl support is enabled, the software fails to enforce the Public Suffix List boundary check while processing a Set-Cookie header. This occurs when the Domain attribute explicitly matches an origin host that is a public suffix, such as co.uk. Instead of treating it as a strict host-only cookie, the system saves it with a wildcard domain scope (.co.uk). This leads to the cookie being incorrectly included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix, such as attacker.co.uk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.