{"id":"CVE-2023-46218","title":"This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible","summary":"This flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unr…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvssSource":"adp","vendor":"curl","product":"curl","affected":["curl >= 8.4.0 <= 8.4.0"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2025-05-28T16:38:08.000092Z"},"exploitAvailable":true,"published":"2023-12-07","updated":"2026-10-15","sourceUpdated":"2026-10-15T00:04:49.559Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-46218","references":[{"url":"https://hackerone.com/reports/2212193"},{"url":"https://curl.se/docs/CVE-2023-46218.html"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/"},{"url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00015.html"},{"url":"https://www.debian.org/security/2023/dsa-5587"},{"url":"https://security.netapp.com/advisory/ntap-20240125-0007/"}],"tags":["cve.org","exploit-available"],"epss":0.01685,"epssPercentile":0.7667,"ingestedAt":"2026-10-15T04:46:37.296Z","slug":"CVE-2023-46218","body":"## Overview\n\nThis flaw allows a malicious HTTP server to set \"super cookies\" in curl that\nare then passed back to more origins than what is otherwise allowed or\npossible. This allows a site to set cookies that then would get sent to\ndifferent and unrelated sites and domains.\n\nIt could do this by exploiting a mixed case flaw in curl's function that\nverifies a given cookie domain against the Public Suffix List (PSL). For\nexample a cookie could be set with `domain=co.UK` when the URL used a lower\ncase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.\n\n## Affected\n\n- `curl >= 8.4.0 <= 8.4.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":35.8,"likelihood":0.3,"exploitation":12,"ransomware":0},"changes":[]}