Insertion of Sensitive Information Into Sent Data in cURL - CVE-2026-82209

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to information exposure through sent data in the libcurl cookie handling logic when processing a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. A remote attacker can induce the client to send a previously stored cookie to an arbitrary sibling subdomain under the same public suffix to disclose sensitive information.

Exploitation requires libpsl support to be enabled, the apex public-suffix host to issue the cookie, and the client to subsequently contact an attacker-controlled sibling subdomain.

Affected software

How to mitigate CVE-2026-82209

External References

• https://curl.se/docs/CVE-2026-82209.html
• https://github.com/curl/curl/commit/95c1e8915dce64606bd753fd47f

Related Security Bulletins

• Multiple vulnerabilities in cURL