Description
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.38.0-1 | — |
| Debian 13 | curl | 7.38.0-1 | — |
| Debian 12 | curl | 7.38.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | curl | 7.35.0-1ubuntu2.1 | USN-2346-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.51.0-1.1 | openSUSE-SU-2024:10303-1 |
Advisories 3
- USN-2346-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10303-1 curl-7.51.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1653 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 4, 2023
References
- 69742 vdb-entry
- APPLE-SA-2015-08-13-2 vendor-advisory
- http://curl.haxx.se/docs/adv_20140910B.html
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
- openSUSE-SU-2014:1139 vendor-advisory
- https://support.apple.com/kb/HT205031
- DSA-3022 vendor-advisory
- [oss-security] 20220511 [SECURITY ADVISORY] curl: cookie for trailing dot TLD mailing-list