{"id":"CVE-2023-46218","revision":"7cdd532641d84dbe97961ead14ca554b","records":[{"revision":"7cdd532641d84dbe97961ead14ca554b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2023-46218","aliases":[],"title":"This flaw allows a malicious HTTP server to set \"super cookies\" in curl that","description":"This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.","state":0,"publishedAt":"2023-12-07T01:10:34.846+00:00","modifiedAt":"2026-10-15T00:04:49.559+00:00","affected":[{"ecosystem":"Vendor product","name":"curl","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"curl\",\n                    \"product\": \"curl\",\n                    \"versions\": [\n                        {\n                            \"version\": \"8.4.0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"8.4.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.46.0\",\n                            \"status\": \"unaffected\",\n                            \"lessThan\": \"7.46.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://hackerone.com/reports/2212193","https://curl.se/docs/CVE-2023-46218.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/","https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html","https://www.debian.org/security/2023/dsa-5587","https://security.netapp.com/advisory/ntap-20240125-0007/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-46218","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-46218","identifiers":["CVE-2023-46218"]},"retained":false,"historicalAffected":[]}],"coverage":[]}