CVE-2026-82209: libcurl Public Suffix List CSRF Vulnerability

CVE-2026-82209 Overview

CVE-2026-82209 is a cookie scoping flaw in libcurl when built with libpsl (Public Suffix List) support. The library fails to enforce the Public Suffix List boundary when a server sets a Set-Cookie header with a Domain attribute matching an origin host that is itself a public suffix. Instead of storing the cookie as host-only, libcurl saves it with wildcard domain scope. The cookie is then attached to outbound requests and HTTP redirects targeting arbitrary sibling subdomains under the same public suffix. The issue is classified under CWE-201: Insertion of Sensitive Information Into Sent Data.

Critical Impact
Cookies set by a public-suffix origin can be leaked to attacker-controlled sibling hosts, exposing session tokens and other sensitive authentication data.

Affected Products

libcurl builds compiled with libpsl support
Applications and command-line tooling linking against affected libcurl versions
HTTP clients relying on libcurl for cookie handling across redirects

Discovery Timeline

2026-09-06 - CVE-2026-82209 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-82209

Vulnerability Analysis

The Public Suffix List (PSL) exists to prevent cookies from being set at registry-level domains such as co.uk, com.au, or github.io. Browsers and HTTP clients consult the PSL to reject Domain attributes that would grant a cookie visibility across unrelated tenants sharing that suffix.

libcurl integrates libpsl to perform this boundary check. However, when the origin host itself equals a public suffix and the server responds with Set-Cookie: name=value; Domain=co.uk, libcurl accepts the domain attribute rather than coercing the cookie into a host-only scope. The resulting cookie is stored with a leading dot (.co.uk), which matches any subdomain under that suffix.

Subsequent requests or 3xx redirects to sibling hosts such as attacker.co.uk will include the cookie in the outbound Cookie header, breaking the tenant isolation the PSL was designed to enforce.

Root Cause

The defect lies in the cookie parsing path that evaluates the Domain attribute against the request origin. When the origin host string matches an entry in the Public Suffix List, libcurl fails to downgrade the cookie to host-only storage. This bypass of the PSL boundary check violates the guidance in RFC 6265 Section 5.3 for public suffix rejection.

Attack Vector

An attacker who controls or compromises any service reachable at a public-suffix hostname can set a cookie with Domain equal to that suffix. Any libcurl-based client that later follows a redirect or issues a request to a sibling host under the same suffix will transmit the cookie. This enables session fixation, cross-tenant tracking, or exfiltration of bearer tokens if the attacker controls a sibling host to which the victim client can be redirected.

No verified exploit code is published. Refer to the cURL CVE-2026-82209 Documentation and HackerOne Report #3972385 for authoritative technical details.

Detection Methods for CVE-2026-82209

Indicators of Compromise

Outbound Cookie headers sent to hosts that do not match the original Set-Cookie origin under a shared public suffix.
Cookie jar entries (curl -c output) containing domain fields such as .co.uk, .com.au, or other registry suffixes with a leading dot.
HTTP 3xx redirect chains that cross into sibling subdomains under a public suffix while carrying session cookies.

Detection Strategies

Inspect application cookie stores generated by libcurl for entries whose domain scope equals a Public Suffix List entry.
Instrument HTTP egress logging to flag Cookie headers dispatched to hosts whose registrable domain differs from the cookie issuer.
Audit dependency manifests and build metadata to identify services statically or dynamically linking vulnerable libcurl builds with libpsl enabled.

Monitoring Recommendations

Correlate proxy and web gateway logs for redirect flows that cross tenant boundaries under shared public suffixes.
Monitor authentication systems for reuse of session identifiers from unexpected client IPs following redirect activity.
Track libcurl version telemetry across managed workloads to identify unpatched runtimes.

How to Mitigate CVE-2026-82209

Immediate Actions Required

Upgrade libcurl to the fixed release identified in the cURL CVE-2026-82209 advisory as soon as it is available in your distribution.
Rebuild statically linked applications against the patched libcurl to ensure the fix is applied at load time.
Rotate session cookies and API tokens that may have been transmitted to unintended hosts through vulnerable clients.

Patch Information

Refer to the cURL CVE-2026-82209 Documentation and the machine-readable JSON details for the fixed version, affected version ranges, and upstream commit references. Distribution maintainers typically backport the fix; verify package versions with your vendor's security tracker.

Workarounds

Disable cookie handling in libcurl-based tooling by omitting -b/-c flags or by not setting CURLOPT_COOKIEFILE and CURLOPT_COOKIEJAR where cookies are unnecessary.
Restrict outbound requests from libcurl clients to allowlisted hosts, preventing redirects to sibling subdomains under public suffixes.
Set CURLOPT_FOLLOWLOCATION to 0 in security-sensitive workflows so cookies are not forwarded through automatic redirects.
Where feasible, rebuild libcurl without libpsl and enforce PSL checks in the calling application until the patched version is deployed.

bash

# Verify installed libcurl version and libpsl linkage
curl --version
ldd "$(which curl)" | grep -Ei 'libcurl|libpsl'

# Disable automatic redirect following in scripted clients
curl --no-location --cookie-jar /dev/null https://example.test/