CVE-2026-82209: 
cURL vulnerability analysis and mitigation

CVE-2026-82209 is a cookie domain scoping vulnerability in curl/libcurl, dubbed "domain-scoped PSL domain cookie," in which libcurl incorrectly handles cookies whose Domain attribute matches a public suffix (e.g., Domain=co.uk set by co.uk). Instead of treating such cookies as host-only, libcurl saves them with wildcard domain scope (.co.uk), causing them to be sent to arbitrary sibling subdomains. Affected versions span curl 7.46.0 through 8.21.0 (inclusive); curl 8.22.0 and later are not affected. The vulnerability carries a severity rating of Low and is classified under CWE-201 (curl Advisory, oss-sec).

The root cause (CWE-201: Information Exposure Through Sent Data) lies in libcurl's failure to enforce the Public Suffix List (PSL) boundary check when libpsl support is enabled and a Set-Cookie header's Domain attribute exactly matches an origin host that is itself a public suffix. Rather than coercing the cookie into a strict host-only scope, libcurl stores it with a wildcard domain (e.g., .co.uk), which is then included in subsequent outbound requests or HTTP redirects to any sibling subdomain under that public suffix. The bug was introduced when PSL support was added in curl 7.46.0 and persisted undetected until reported on August 26, 2026 (curl Advisory). The introducing commit is e77b5b7453c1e8ccd7ec08 and the fix is in commit 95c1e8915dce64606bd753fd47f (curl Advisory).

Exploitation can result in sensitive cookie data (e.g., session tokens, authentication credentials) being unintentionally transmitted to attacker-controlled sibling subdomains under the same public suffix, constituting an information disclosure risk. However, exploitation is constrained: an attacker cannot plant the cookie themselves — the apex public-suffix domain must issue the cookie, and the curl client must subsequently contact the attacker's sibling domain. The practical impact is therefore limited to scenarios where a legitimate apex domain sets such a cookie and the victim client is redirected or otherwise contacts an attacker-controlled sibling (curl Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the advisory date. The CVE status is "Reserved" and the severity is rated Low, reflecting the constrained exploitation preconditions. The vulnerability was discovered and reported by Stanislav Fort of Aisle Research, who reportedly identified six curl CVEs in this research cycle (Aisle Blog, curl Advisory). No EPSS score or CISA KEV catalog entry is currently available for this CVE.

1. Precondition — Apex domain issues a PSL-scoped cookie: The attacker must control or observe a scenario where a legitimate apex public-suffix domain (e.g., co.uk) issues a Set-Cookie header with Domain=co.uk to a curl client running a vulnerable version (7.46.0–8.21.0 with libpsl enabled).
2. Cookie stored with wildcard scope: Due to the bug, libcurl stores the cookie with wildcard domain scope (.co.uk) rather than as a host-only cookie, making it eligible for transmission to any subdomain under co.uk.
3. Redirect or request to attacker sibling: The attacker arranges for the curl client to subsequently make an HTTP request or follow a redirect to an attacker-controlled sibling subdomain (e.g., attacker.co.uk).
4. Cookie transmitted to attacker: libcurl includes the improperly scoped cookie in the outbound request to attacker.co.uk, exposing its contents to the attacker (curl Advisory).

• Network: Outbound HTTP requests from a curl client to unexpected sibling subdomains under a public suffix, carrying Cookie: headers that should not be scoped to those domains.
• Logs: Application or proxy logs showing Cookie headers sent to domains that are siblings of a public suffix (e.g., requests to attacker.co.uk including cookies originally set by co.uk).
• Configuration: Presence of curl versions 7.46.0–8.21.0 with libpsl support enabled in the environment, identifiable via curl --version output (curl Advisory).

The primary remediation is to upgrade curl to version 8.22.0, released September 2, 2026, which includes the fix in commit 95c1e8915dce64606bd753fd47f. Alternatively, the patch can be applied manually to a local build. As a last resort, disabling cookie usage entirely in libcurl/curl eliminates the attack surface. Organizations should audit deployments of curl 7.46.0–8.21.0 with libpsl enabled and prioritize upgrading, particularly in environments where curl clients interact with domains at or near public suffix boundaries (curl Advisory, Daniel Haxx Blog).

The vulnerability was reported by Stanislav Fort of Aisle Research, which published a blog post noting that their researchers discovered six curl CVEs — drawing implicit contrast with AI tools (OpenAI and Anthropic) that found zero (Aisle Blog). The curl project lead Daniel Stenberg patched the issue and coordinated disclosure with the curl 8.22.0 release announcement (Daniel Haxx Blog). The issue was also disclosed on the oss-security mailing list (oss-sec).