Description
This flaw allows a malicious HTTP server to set "super cookies" in curl that
are then passed back to more origins than what is otherwise allowed or
possible. This allows a site to set cookies that then would get sent to
different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that
verifies a given cookie domain against the Public Suffix List (PSL). For
example a cookie could be set with `domain=co.UK` when the URL used a lower
case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| curl | curl | 8.4.0 – ≤ 8.4.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | curl | 8.5.0-1 | — |
| Debian 13 | curl | 8.5.0-1 | — |
| Debian 12 | curl | 7.88.1-10+deb12u5 | DSA-5587-1 |
| Debian 11 | curl | 7.74.0-1.3+deb11u11 | DSA-5587-1 |
| Debian 10 | curl | 7.64.0-4+deb10u8 | DLA-3692-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | curl | 7.81.0-1ubuntu1.15 | USN-6535-1 |
| Ubuntu 20.04 LTS | curl | 7.68.0-1ubuntu2.21 | USN-6535-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | curl | 7.58.0-2ubuntu3.24+esm3 | USN-6641-1 |
| Ubuntu Pro 16.04 LTS | curl | 7.47.0-1ubuntu2.19+esm11 | USN-6641-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | curl +4 | 7.76.1-26.el9_3.3 | RHSA-2024:1129 |
| RHEL 8 | curl +3 | 7.61.1-33.el8_9.5 | RHSA-2024:1601 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | curl +4 | 7.76.1-23.el9_2.6 | RHSA-2024:0452 |
| RHEL 9.0 EUS | curl +4 | 7.76.1-14.el9_0.11 | RHSA-2024:0434 |
| RHEL 8.8 EUS | curl +3 | 7.61.1-30.el8_8.9 | RHSA-2024:0585 |
| RHEL 8.6 EUS | curl +3 | 7.61.1-22.el8_6.12 | RHSA-2024:0428 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-curl +2 | 8.6.0-3.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-httpd +6 | 2.4.57-9.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_proxy_cluster | 1.3.20-3.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-mod_ssl +1 | 1:2.4.57-9.el7jbcs | RHSA-2024:1316 |
| Red Hat JBoss Core Services 1 | jbcs-httpd24-openssl +4 | 1:1.1.1k-17.el7jbcs | RHSA-2024:1316 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | curl +4 | 7.76.1-26.el9_3.3 | ALSA-2024:1129 |
| AlmaLinux 8 | curl +3 | 7.61.1-33.el8_9.5 | ALSA-2024:1601 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | curl | 7.61.1-33.el8_9.5 | RLSA-2024:1601 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLES 15 SP4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLES 15 SP1 | curl | 7.60.0-150000.56.1 | SUSE-SU-2023:4650-1 |
| SLES 12 SP5 | curl | 8.0.1-11.80.1 | SUSE-SU-2023:4653-1 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP1 | curl | 7.60.0-150000.56.1 | SUSE-SU-2023:4650-1 |
| SLES for SAP 12 SP5 | curl | 8.0.1-11.80.1 | SUSE-SU-2023:4653-1 |
| SLE Micro 5.5 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLE Micro 5.4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLE Micro 5.3 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| SLE Micro 5.2 | curl | 7.66.0-150200.4.63.1 | SUSE-SU-2023:4713-1 |
| SLE Micro 5.1 | curl | 7.66.0-150200.4.63.1 | SUSE-SU-2023:4713-1 |
| SLE HPC 15 SP1 | curl | 7.60.0-150000.56.1 | SUSE-SU-2023:4650-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | curl | 8.5.0-1.1 | openSUSE-SU-2024:13509-1 |
| openSUSE Leap 15.5 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| openSUSE Leap 15.4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.4 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
| openSUSE Leap Micro 5.3 | curl | 8.0.1-150400.5.36.1 | SUSE-SU-2023:4659-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | curl | 8.5.0-r0 | — |
| Alpine v3.23 | curl | 8.5.0-r0 | — |
| Alpine v3.22 | curl | 8.5.0-r0 | — |
| Alpine v3.21 | curl | 8.5.0-r0 | — |
| Alpine v3.20 | curl | 8.5.0-r0 | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | curl | 8.5.0-r0 | — |
| Alpine v3.18 | curl | 8.5.0-r0 | — |
| Alpine v3.17 | curl | 8.5.0-r0 | — |
| Alpine v3.16 | curl | 8.5.0-r0 | — |
| Alpine v3.15 | curl | 8.5.0-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | curl +4 | 8.5.0-1.amzn2023.0.2 | ALAS2023-2024-606 |
| Amazon Linux 2 | curl +2 | 8.3.0-1.amzn2.0.6 | ALAS2-2024-2531 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cmake | 3.29.6-1 | — |
| Azure Linux 3 | mysql | 8.0.40-1 | — |
| Azure Linux 2 (CBL-Mariner) | cmake | 3.21.4-13 | — |
| Azure Linux 2 (CBL-Mariner) | curl | 8.5.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | mysql | 8.0.35-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | curl +4 | 7.76.1-26.el9_3.3 | ELSA-2024-1129 |
| Oracle Linux 8 | curl +3 | 7.61.1-33.el8_9.5 | ELSA-2024-1601 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | curl | 8.5.0-r0 | — |
Advisories 45
- ALSA-2024:1129 Moderate: curl security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:1601 Moderate: curl security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:1601 Red Hat Security Advisory: curl security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:1316 Red Hat Security Advisory: Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:1129 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0585 Red Hat Security Advisory: curl security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0452 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0434 Red Hat Security Advisory: curl security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:0428 Red Hat Security Advisory: curl security and bug fix update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- WID-SEC-2024-0992 Tenable Security Nessus Network Monitor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 31, 2026
- WID-SEC-2025-0148 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- USN-6641-1 curl vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- ICSA-25-162-05 Siemens SIMATIC S7-1500 CPU family CISA ICS & IT advisories · May 14, 2026
- WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- USN-6535-1 curl vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-5587-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3692-1 curl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:1601 Moderate: curl security and bug fix update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2023:4713-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4650-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4659-1 Security update for curl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13509-1 curl-8.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0180 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- NCSC-2025-0382 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Dec 9, 2025
- SSA-202008 SSA-202008: Multiple Vulnerabilities in Ruggedcom Rox Before V2.17.0 Siemens ProductCERT · Dec 9, 2025
- WID-SEC-2024-1086 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 19, 2025
- WID-SEC-2024-3377 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 12, 2025
- WID-SEC-2023-3060 cURL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 10, 2025
- NCSC-2025-0187 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 10, 2025
- WID-SEC-2024-0899 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 9, 2025
- VDE-2024-073 Phoenix Contact: Multiple Vulnerabilities in PLCnext Firmware CERT@VDE · May 22, 2025
- SUSE-SU-2023:4653-1 Security update for curl SUSE / openSUSE Security Updates · May 2, 2025
- NCSC-2025-0021 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jan 22, 2025
- NCSC-2024-0433 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 12, 2024
- ICSA-24-319-04 Siemens SINEC NMS CISA ICS & IT advisories · Nov 12, 2024
- SSA-331112 SSA-331112: Multiple Vulnerabilities in SINEC NMS Before V3.0 SP1 Siemens ProductCERT · Nov 12, 2024
- NCSC-2024-0293 Kwetsbaarheden verholpen in Oracle Communications Applications NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1643 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- ICSA-24-137-07 Siemens SIMATIC RTLS Locating Manager CISA ICS & IT advisories · Jun 11, 2024
- SSA-093430 SSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.0 Siemens ProductCERT · Jun 11, 2024
- ALAS2023-2024-606 Moderate: curl security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Apr 25, 2024
- ALAS2-2024-2531 Moderate: curl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 24, 2024
- ELSA-2024-1601 Moderate: curl security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 3, 2024
- ELSA-2024-1129 Moderate: curl security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Mar 6, 2024
References
- https://hackerone.com/reports/2212193
- https://curl.se/docs/CVE-2023-46218.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/
- https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html
- https://www.debian.org/security/2023/dsa-5587
- https://security.netapp.com/advisory/ntap-20240125-0007/