CVE-2026-82209

Executive Summary

CVE-2026-82209 is an unpatched cookie-handling vulnerability in libcurl affecting applications that have compiled libcurl with libpsl (Public Suffix List) support. The flaw causes libcurl to incorrectly preserve a Set-Cookie header with a broad domain scope (.co.uk) when a legitimate public-suffix origin (e.g., co.uk) sets the cookie for itself, instead of coercing it into a strict host-only cookie. As a result, the cookie is leaked to arbitrary sibling subdomains under the same public suffix, enabling session hijacking and cross-origin data exposure in applications that rely on libcurl for HTTP requests and redirects. Attackers can trigger this condition by establishing control of a sibling subdomain under the victim's public suffix and passively or actively collecting the leaked cookies.

Technical Analysis

The vulnerability is rooted in how libcurl processes the Domain attribute of cookies derived from HTTP Set-Cookie response headers when libpsl support is enabled at build time.

Public suffixes (e.g., .co.uk, .com.au, .github.io) are top-level registrable domains under which independent registrants may control distinct subdomains. Cookies are meant to be scoped to a single registered domain that the origin server legitimately controls. RFC 6265 states that if a server's hostname matches the Domain attribute value exactly, and that value is a public suffix, the cookie MUST NOT have its domain attribute used to broaden the cookie's scope to the public suffix; the cookie must instead be stored as a "host-only" cookie, meaning it is sent back only to the exact host that set it. This rule prevents a cookie set by co.uk (the registrable suffix itself) from being visible to attacker.co.uk, which the same server does not control.

The vulnerability exists because libcurl fails to enforce this boundary check precisely when (a) libpsl support is enabled, and (b) the Domain attribute in the incoming Set-Cookie header matches the origin host that is itself a public suffix. In this scenario libcurl does not convert the cookie into a host-only cookie. Instead, it stores the cookie with a wildcard domain scope (.co.uk), meaning it will attach the cookie to any outbound request whose hostname ends with .co.uk — including sibling subdomains that the cookie-setting authority does not control.

The mechanism of failure is in the cookie-set parsing and sorting logic inside libcurl's cookie module. Prior to accepting a cookie, the code is expected to compare the Domain attribute string against the PSL list and ensure that the requested domain scope does not exceed the public suffix boundary of the origin hostname. The missing check means that a cookie's in-memory metadata stores an unrestricted domain string, and all future requests destined for any sibling subdomain match this domain scope filter through normal cookie-matching logic.

The outbound leak surface is exacerbated in HTTP redirects: if a request to the legitimate public-suffix origin results in a 3xx redirect to a sibling subdomain under the same public suffix (a standard technique used by CDNs, login gateways, and shared infrastructure), libcurl automatically follows the redirect and attaches the leaked cookie in the subsequent request. No malicious code execution is required server-side; the flaw is entirely in the client-side cookie policy implementation.

Attack surface: any libcurl-using agent that (1) makes requests to hosts which are themselves public suffixes, (2) receives a Set-Cookie response from those hosts, and (3) subsequently follows requests to sibling subdomains. This includes command-line tools, embedded firmware HTTP clients, development SDKs, and server-side components that perform outbound HTTP proxying or API aggregation via libcurl. Note that default hardening in most public builds does include libpsl; however, configurations that enable this flag are the affected population.

Exploitation Scenarios

The attack chain is inferred strictly from the vulnerability class, the described conditions, and the nature of public-suffix domains. No public PoC exists, and the attack chain below is constructed from the mechanics described in the NVD entry.

1) Reconnaissance / target identification The attacker must identify an environment where libcurl with libpsl is used and where the HTTP client interacts with a host that is itself a public suffix (e.g., co.uk, com.au, github.io, or a PSL-listed private domain delegated to a third-party). Servers of such public-suffix hosts will set cookies via Set-Cookie headers in response to HTTP requests. Because the flaw is client-side, the attacker also needs to determine the set of sibling subdomains that the victim client legitimately later visits — ideally those allowing attacker registration. Public registrars and shared-hosting providers where anyone can register any subdomain (e.g., .github.io, certain dynamic DNS services, or country-suffix registries with open second-level domains) provide the highest feasibility.

2) Triggering the flaw The attacker does not directly manipulate the victim client; they rely on the victim's own traffic. During any HTTPS request made by the victim's libcurl client to a hostname that is a public suffix (e.g., the landing page of co.uk), the server at that public suffix responds with an HTTP response containing a Set-Cookie: session=...; Domain=co.uk; Path=/ header. In a conformant implementation, this would result in a host-only cookie scoped to co.uk — but because of the vulnerable libcurl path, the cookie is stored with domain scope .co.uk.

3) Payload / execution method at the class level The victim's libcurl client later makes an HTTP request to, or is HTTP-redirected to, an attacker-controlled subdomain sharing the same public suffix — e.g., attacker.co.uk. The following conditions apply: (a) the request passes the cookie-domain matching logic, (b) the session cookie value is sent in the Cookie header, and (c) the attacker's server logs the value. In situations where the victim accesses the public-suffix host with associated redirect behavior to third party subdomains (a CDN redirect, for instance, from co.uk/path to shop.co.uk/path), the automatic redirect handling of libcurl causes cookie leakage without any visibility to the victim application developer.

Now the attacker holds the session identifier of a legitimate user session. If the public-suffix origin used that cookie for user authentication or CSRF token state, the attacker can replay the cookie from their own client against the legitimate public-suffix origin — the victim user’s session is now hijacked. Persistence of the attack is not needed since cookie leakage happens on every new session creation.

4) Post-exploitation impact The attacker decodes the leaked cookie, adds it to their own HTTP client, and interacts with the application as the victim. Depending on the session's backend, the impact ranges from data exfiltration (read private user data), to unauthorized transactions (e-commerce, bank interfaces using public-suffix top domains), to account takeover. In multi-tenant SaaS environments hosted under a shared public suffix (e.g., a corporate instance at customer.saas-provider.com where the provider itself is PSL-listed private domain), the leakage can cross tenant boundaries, resulting in cross-tenant session compromise.

Impact Assessment

The credential and session confidentiality impact is High when the attack succeeds: an attacker who can control or observe a sibling subdomain can intercept cookies that were intended to be host-scoped, leading to full session hijacking. The attack relies on a unique pre-condition — the origin host being a public suffix — which is not prevalent across all libcurl deployments but is meaningful in regions with ccTLD-based public suffixes (UK, Australia, New Zealand) and in private domain sections of the PSL (shared hosting, PaaS). For enterprise SOC teams: consider assessments of any in-house software that embeds libcurl and contacts PSL-listed apex domains, because the exposure is silent — no application-level error or log is produced. Availability is not directly impacted. Integrity is impacted if the hijacked session permitted administrative write operations. Since the CVSS provided is N/A — no score is available from the assigning CNA — impact classification relies on the description’s language and the standard CD(C)/ID(C)/IA(N) triad reasoning: Confidentiality high, Integrity high (when sessions permit writes), Availability none. Blast radius includes all cookies whose Domain equals a public suffix set by that public suffix host, and all subsequent requests to sibling subdomains over the lifetime of the cookie. No known active exploitation has been observed to date; no entry appears on the CISA KEV catalog.

Detection Guidance

Detection of this flaw is uniquely difficult because exploitation occurs client-side during ordinary, non-malformed HTTP traffic. The transmitted stream contains no exploit syntax. Detection is therefore split into anomaly detection on outbound request patterns and host-based monitoring of a known-bad response pattern.

Sigma Rule

The following Sigma rule detects client-side events where a HTTP response arriving at a log-enabled libcurl process contains a Set-Cookie with a Domain attribute equal to a known public-suffix string — a strong indicator of this vulnerable code path having been exercised. Adjust the event fields based on your curl instrumentation.

title: libcurl Public Suffix Cookie Scope Bypass (CVE-2026-82209)
id: 4fb3bc68-9f1b-4d4b-b12d-2a66c3fb78a1
status: experimental
description: >
  Detects responses observed by libcurl processes where a Set-Cookie header contains
  a Domain attribute that matches a public suffix (heuristic top-level). Combined with
  known PSL entries, such cookies should never be stored with a wildcard scope.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82209
author: Valtersit Threat Intel
date: 2026/01/01
logsource:
    category: proxy
    product: http
detection:
    selection:
        http.response.header|contains: "Set-Cookie:"
        http.response.body|contains:
            - "Domain=co.uk"
            - "Domain=com.au"
            - "Domain=github.io"
            - "Domain=uk.com"
    condition: selection
falsepositives:
    - Legitimate long-lived cookies deliberately set with broad scope on misconfigured
      origin servers (these are still a security risk and should be investigated).
level: medium

YARA Rule

YARA detection is for filesystem or memory scanning of static libcurl builds to identify a vulnerable configuration — i.e., a curl binary that links libpsl while lacking a defensive version check. The following rule flags the presence of both the expected libpsl symbol and generic libcurl cookie handling structures. It is a weak signal and must be combined with version checking.

rule CVE_2026_82209_libcurl_psl_mismatch
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Heuristic detection of libcurl binaries that include libpsl support and hence may be vulnerable to CVE-2026-82209."
        cve = "2026-82209"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $psl_init = "psl_builtin" ascii
        $psl_free  = "psl_free" ascii
        $curl_cookie = "curl_easy_setopt" ascii
        $ccookie = "CURLOPT_COOKIELIST" ascii
        $psl_check = "psl_is_public_suffix" ascii
    condition:
        uint16(0) == 0x5A4D and  // MZ header
        ( $psl_init or $psl_free or $psl_check ) and
        ( $curl_cookie or $ccookie )
}

Suricata IDS Rule

The following rule looks at unencrypted SMTP/HTTP traffic as a network-based control; for TLS encrypted traffic this rule is only useful if a proxy decrypts. It detects HTTP response headers where a cookie Domain attribute matches a public suffix entry — a faulty server exchange that should never be honored with a broad cookie scope by any client.

alert http any any -> any any (msg:"CVE-2026-82209 Public Suffix Domain Cookie from Set-Cookie Response"; flow:to_client,established; content:"Set-Cookie"; http_header; nocase; content:"Domain=co.uk"; http_header; nocase; sid:2026822091; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve 2026-82209;)

Elastic Detection

The EQL query below monitors application logs where a user-agent string indicates libcurl and where the raw response content includes the specific vulnerable pair pattern — the request URI host equals a PSL entry and the Set-Cookie domain header matches it.

sequence by host.name, process.name with maxspan=5m
  [ network where dns.question.name in ("co.uk", "com.au", "github.io") ]
  [ file where event.category == "file" and
      process.name == "curl" and
      file.path == "*log*" and
      file.text : "*Set-Cookie*Domain=co.uk*"
  ]

Splunk SPL Query

Run against proxy, DNS, and host-level logs in a merged index:

index=* sourcetype=httpproxy OR sourcetype=curl_log
| where like(lower(headers), "%domain=co.uk%") AND (match(lower(uri_host), "co\.uk$") OR match(lower(uri_host), "com\.au$") OR match(lower(uri_host), "github\.io$"))
| stats count by src_ip, uri_host, headers
| where count > 1

Wazuh OSSEC Rule

The following Wazuh local ruleset entry alerts when any monitored log file (from syslog or an application) contains a Set-Cookie header with an enabled public suffix domain constant such as Domain=co.uk and an associated request path.

<group name="curl,cookie,publicsuffix,">
  <rule id="920895" level="8">
    <decoded_as>json</decoded_as>
    <field name="response_headers">Set-Cookie</field>
    <regex>Domain=co\.uk|Domain=com\.au|Domain=github\.io</regex>
    <description>CVE-2026-82209: libcurl accepted a public-suffix scoped cookie from Set-Cookie response</description>
    <group>pci_dss_6.5,cve_2026_82209,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, commit, advisory, or vendor version is available from any tracked source at the time of writing. Treat all deployments as vulnerable until the curl project issues a statement.

1. Immediate mitigations

   • Disable libpsl support in libcurl builds (configure with --without-libpsl) if your application does not rely on PSL-aware cookie handling. This removes the affected code path entirely.
   • At the application layer, enforce strict host-only cookies: strip any Domain attribute from response headers before the header reaches libcurl's cookie engine, particularly when the origin host is a public suffix.
   • For applications that have visibility into response processing, drop cookies whose Domain value equals the request URI's host when that host is an entry in the PSL.
   • Deploy a response header filter in an egress proxy or WAF that blocks/rewrites outbound Set-Cookie headers where the Domain attribute matches any PSL-listed value.

2. Patch/upgrade steps

   • Monitor the curl GitHub repository and the curl security mailing list (https://curl.se/docs/security.html) for an official fix. Apply the patched version immediately upon release.
   • If patching is not possible, rebuild libcurl with PSL disabled and test the cookie behavior in a staging environment replicating the affected scenario.

3. Long-term hardening

   • For any software development that outsources HTTP to libcurl, schedule automated regression tests using a test server on a public-suffix domain (obtain one via a PSL-listed ccTLD) that sets a Domain=publicsuffix cookie, then assert that the cookie is not sent to a sibling subdomain.
   • Ensure that HTTP redirect following in libcurl (CURLOPT_FOLLOWLOCATION) is accompanied by limit checks on the destination host — consider disabling redirects to sibling subdomains when anti-CSRF cookies are present.
   • Update cookie handling code in downstream frameworks to enforce RFC 6265 Section 5.3.6 (public-suffix check) independent of the underlying library.
   • Subscribe to CISA KEV and curl security advisories to be notified if this CVE is added to CISA’s known exploited vulnerabilities catalog or if exploit activity is observed.

References

• NVD Entry for CVE-2026-82209: https://nvd.nist.gov/vuln/detail/CVE-2026-82209
• curl Security Advisories page: https://curl.se/docs/security.html
• Public Suffix List (Mozilla): https://publicsuffix.org/
• RFC 6265 (HTTP State Management Mechanism): https://datatracker.ietf.org/doc/html/rfc6265
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns have been attributed to this CVE. No exploit-in-the-wild evidence exists at this time.