CVE-2023-46218

What it actually does

A mixed-case flaw in curl's Public Suffix List domain verification allows a malicious HTTP server to set cookies using uppercase characters (for example domain=co.UK) that bypass intended restrictions and are sent to additional unrelated origins.

Why it matters to the business

Attackers can track users or hijack sessions across unrelated domains, increasing privacy exposure and the risk of unauthorized access in environments that rely on curl for HTTP operations.

How an attack unfolds

An attacker hosts a malicious HTTP server that returns Set-Cookie headers crafted with mixed-case PSL domains. Curl incorrectly accepts and stores these cookies due to the case-sensitivity flaw, then forwards them to other sites that match the PSL entry on subsequent requests.

How to fix it

Upgrade curl to a patched version that performs case-insensitive PSL comparisons. Rebuild or reinstall affected packages from fedoraproject fedora once updates are available and test cookie behavior in applications using libcurl.

How to confirm the fix worked

Confirm curl version is updated, then test Set-Cookie acceptance using mixed-case domains against known PSL entries such as co.uk to verify proper rejection.

Typical attack path

1. Attacker controls a malicious HTTP server
2. Server responds to curl client with Set-Cookie header containing mixed-case PSL domain
3. Curl accepts and stores the cookie despite PSL match
4. Cookie is transmitted to unrelated domains on future requests

How to detect it

Inspect application and system logs for Set-Cookie headers containing mixed-case PSL domains and review curl client activity involving untrusted HTTP responses.

What your security team should do

• Prioritize upgrading all curl installations to the latest fixed release
• Review and restrict use of curl in automated or untrusted HTTP flows
• Monitor upstream haxx curl announcements for patch availability