Description
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on `foo.example.com` can set cookies that also would match for `bar.example.com`, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | https://github.com/curl/curl | Fixed in 7.84.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 7.84.0-1 | — |
| Debian 13 | curl | 7.84.0-1 | — |
| Debian 12 | curl | 7.84.0-1 | — |
| Debian 11 | curl | 7.74.0-1.3+deb11u2 | DSA-5197-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.3 | USN-5495-1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.12 | USN-5495-1 |
| Ubuntu 18.04 LTS | curl | 7.58.0-2ubuntu3.19 | USN-5495-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | curl | 7.79.1-150400.5.3.1 | SUSE-SU-2022:2305-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 7.84.0-1.1 | openSUSE-SU-2024:12214-1 |
| openSUSE Leap 15.4 | curl | 7.79.1-150400.5.3.1 | SUSE-SU-2022:2305-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 7.84.0-r0 | — |
| Alpine v3.23 | curl | 7.84.0-r0 | — |
| Alpine v3.22 | curl | 7.84.0-r0 | — |
| Alpine v3.21 | curl | 7.84.0-r0 | — |
| Alpine v3.20 | curl | 7.84.0-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 7.84.0-r0 | — |
| Alpine v3.18 | curl | 7.84.0-r0 | — |
| Alpine v3.17 | curl | 7.84.0-r0 | — |
| Alpine v3.16 | curl | 7.83.1-r2 | — |
| Alpine v3.15 | curl | 7.80.0-r2 | — |
| Alpine v3.14 | curl | 7.79.1-r2 | — |
| Alpine v3.13 | curl | 7.79.1-r2 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 7.87.0-2.amzn2023.0.2 | ALAS2023-2023-083 |
| Amazon Linux 2 | curl +2 | 7.79.1-6.amzn2.0.1 | ALAS2-2022-1875 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | curl | 7.84.0-1 | — |
Advisories 26
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2022-1846 Apple macOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- USN-5495-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5197-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:12214-1 curl-7.84.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2305-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2022-0479 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 6, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- VDE-2023-001 PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · Jun 5, 2025
- VDE-2022-046 PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- ICSA-23-103-09 Siemens SCALANCE XCM332 CISA ICS & IT advisories · May 6, 2025
- ALAS2023-2023-083 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 15, 2024
- WID-SEC-2023-1614 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2023
- WID-SEC-2023-1728 Autodesk AutoCAD: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 11, 2023
- SSA-942865 SSA-942865: Multiple Vulnerabilities in the Integrated SCALANCE S615 of SINAMICS Medium Voltage Products Siemens ProductCERT · Jun 14, 2023
- ICSA-23-166-12 Siemens SINAMICS Medium Voltage Products CISA ICS & IT advisories · Jun 14, 2023
- SSA-558014 SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 Siemens ProductCERT · Apr 11, 2023
- SSA-419740 SSA-419740: Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.2 Siemens ProductCERT · Mar 14, 2023
- ICSA-23-075-01 Siemens SCALANCE, RUGGEDCOM Third-Party CISA ICS & IT advisories · Mar 14, 2023
- SSA-333517 SSA-333517: Multiple Vulnerabilities in SCALANCE SC-600 Family before V3.0 Siemens ProductCERT · Dec 13, 2022
- ICSA-22-349-18 Siemens SCALANCE SC-600 Family CISA ICS & IT advisories · Dec 13, 2022
- ALAS2-2022-1875 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 8, 2022
References
- https://hackerone.com/reports/1569946
- FEDORA-2022-1b3d7f6973 vendor-advisory
- DSA-5197 vendor-advisory
- https://security.netapp.com/advisory/ntap-20220915-0003/
- https://support.apple.com/kb/HT213488
- 20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13 mailing-list
- 20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13 mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
- GLSA-202212-01 vendor-advisory