CVE-2026-82209

The record

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

Affected packages

Related vulnerabilities

• CVE-2026-80255 A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii… CWE-201
• CVE-2026-64643 Next.js is a React framework for building full-stack web applications. CWE-201
• CVE-2026-54171 Excon is usable, fast, simple HTTP 1.1 for Ruby. CWE-201
• CVE-2026-42505 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network… CWE-201
• CVE-2026-57318 Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. CWE-201
• CVE-2026-54834 Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. CWE-201
• CVE-2026-55180 pnpm is a package manager. CWE-201
• CVE-2026-54848 Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts… CWE-201