Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2023-46218: curl can send cookies to unrelated sites
CVE-2023-46218 · published 2 years ago
Summary
The curl tool can be tricked into setting special cookies that are then sent to websites they were not meant for. This happens because curl does not correctly check the domain rules when the case of letters is mixed. Updating curl to a version that fixes this check or disabling cookie handling for untrusted sources removes the risk.
What to do
- Update debian curl to version 7.88.1-10+deb12u5.
- Update debian curl to version 8.5.0-1.
- Update curl to version 8.5.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | haxx | curl |
>= 7.46.0, <= 8.4.0 cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
39 cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* |
| – | curl | curl | <= 8.4.0 |
| Debian:12 | debian | curl |
< 7.88.1-10+deb12u5 Fix: upgrade to 7.88.1-10+deb12u5
|
| Debian:13 | debian | curl |
< 8.5.0-1 Fix: upgrade to 8.5.0-1
|
| Alpine:v3.15 | – | curl |
>= 7.46.0, < 8.5.0-r0 Fix: upgrade to 8.5.0-r0
|
Original advisory text
cookie mixed case PSL bypass
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
References
- https://security-tracker.debian.org/tracker/CVE-2023-46218 Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2023-46218 Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html URL
- https://cert-portal.siemens.com/productcert/html/ssa-093430.html URL
- https://cert-portal.siemens.com/productcert/html/ssa-202008.html URL
- https://cert-portal.siemens.com/productcert/html/ssa-331112.html URL
- https://curl.se/docs/CVE-2023-46218.html URL
- https://hackerone.com/reports/2212193 URL
- https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html URL
- https://security.netapp.com/advisory/ntap-20240125-0007/ Vendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46218... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-46218 Vendor Advisory
- https://www.debian.org/security/2023/dsa-5587 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-178Improper Handling of Case Sensitivity
Timeline
Published7 Dec 2023
Updated3 Nov 2026
First seen25 Apr 2026
Sources
CURL-CVE-2023-46218 · OSV
CVE-2023-46218 · NVD
CVE-2023-46218 · MITRE
DEBIAN-CVE-2023-46218 · OSV
ALPINE-CVE-2023-46218 · OSV
CVE-2023-46218 · OSV
Track software like this
Free during beta