Medium
cookie mixed case PSL bypass
Type: advisorySources: OSV
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lowercase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-46218
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:39 UTC · Revision 1
Source evidence
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lowercase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.
osv:CURL-CVE-2023-46218
Complete source record
{
"id": "dd4e91dd6b09c0c72346123df4b279cd1bde0dd789b10375fd8b3b14161bc720",
"url": "https://osv.dev/vulnerability/CURL-CVE-2023-46218",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "cookie mixed case PSL bypass",
"summary": "This flaw allows a malicious HTTP server to set \"super cookies\" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lowercase hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.",
"evidence": "osv:CURL-CVE-2023-46218",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2023-46218",
"aliases": [
"CURL-CVE-2023-46218",
"CVE-2023-46218"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.46.0"
},
{
"fixed": "8.5.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "e77b5b7453c1e8ccd7ec0816890d98e2f392e465"
},
{
"fixed": "2b0994c29a721c91c572cff7808c572a24d251eb"
}
]
}
],
"versions": [
"8.4.0",
"8.3.0",
"8.2.1",
"8.2.0",
"8.1.2",
"8.1.1",
"8.1.0",
"8.0.1",
"8.0.0",
"7.88.1",
"7.88.0",
"7.87.0",
"7.86.0",
"7.85.0",
"7.84.0",
"7.83.1",
"7.83.0",
"7.82.0",
"7.81.0",
"7.80.0",
"7.79.1",
"7.79.0",
"7.78.0",
"7.77.0",
"7.76.1",
"7.76.0",
"7.75.0",
"7.74.0",
"7.73.0",
"7.72.0",
"7.71.1",
"7.71.0",
"7.70.0",
"7.69.1",
"7.69.0",
"7.68.0",
"7.67.0",
"7.66.0",
"7.65.3",
"7.65.2",
"7.65.1",
"7.65.0",
"7.64.1",
"7.64.0",
"7.63.0",
"7.62.0",
"7.61.1",
"7.61.0",
"7.60.0",
"7.59.0",
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"tiny-curl-8_4_0",
"curl-8_4_0",
"curl-8_3_0",
"curl-8_2_1",
"curl-8_2_0",
"curl-8_1_2",
"curl-8_1_1",
"curl-8_1_0",
"curl-8_0_1",
"curl-8_0_0",
"curl-7_88_1",
"curl-7_88_0",
"curl-7_87_0",
"curl-7_86_0",
"curl-7_85_0",
"curl-7_84_0",
"curl-7_83_1",
"curl-7_83_0",
"curl-7_82_0",
"curl-7_81_0",
"curl-7_80_0",
"curl-7_79_1",
"curl-7_79_0",
"curl-7_78_0",
"curl-7_77_0",
"curl-7_76_1",
"curl-7_76_0",
"curl-7_75_0",
"curl-7_74_0",
"curl-7_73_0",
"tiny-curl-7_72_0",
"curl-7_72_0",
"curl-7_71_1",
"curl-7_71_0",
"curl-7_70_0",
"curl-7_69_1",
"curl-7_69_0",
"curl-7_68_0",
"curl-7_67_0",
"curl-7_66_0",
"curl-7_65_3",
"curl-7_65_2",
"curl-7_65_1",
"curl-7_65_0",
"curl-7_64_1",
"curl-7_64_0",
"curl-7_63_0",
"curl-7_62_0",
"curl-7_61_1",
"curl-7_61_0",
"curl-7_60_0",
"curl-7_59_0",
"curl-7_58_0",
"curl-7_57_0",
"curl-7_56_1",
"curl-7_56_0",
"curl-7_55_1",
"curl-7_55_0",
"curl-7_54_1",
"curl-7_54_0",
"curl-7_53_1",
"curl-7_53_0",
"curl-7_52_1",
"curl-7_52_0",
"curl-7_51_0",
"curl-7_50_3",
"curl-7_50_2",
"curl-7_50_1",
"curl-7_50_0",
"curl-7_49_1",
"curl-7_49_0",
"curl-7_48_0",
"curl-7_47_1",
"curl-7_47_0",
"curl-7_46_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2023-46218.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2023-46218-04099297",
"digest": {
"length": 10170,
"function_hash": "138260655856239098081716053511788377221"
},
"source": "https://github.com/curl/curl.git/commit/2b0994c29a721c91c572cff7808c572a24d251eb",
"target": {
"file": "lib/cookie.c",
"function": "Curl_cookie_add"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2023-46218-640d5c49",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70157023922273088324427000884924629680",
"92437533074026318023754548512791708265",
"174781051971824864692061611806535615933",
"317717153087227730924384644852634401824",
"320223818076096336606365255275427779195",
"147452772515304361370177013713828761412",
"163503535934513669771314972304392725527",
"231785432830425780566036868222861730032",
"286735239701402540127725202216210978251",
"193259407853272010415575233417515494247",
"49884205652123128562972741131269080654"
]
},
"source": "https://github.com/curl/curl.git/commit/2b0994c29a721c91c572cff7808c572a24d251eb",
"target": {
"file": "lib/cookie.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:05:26Z"
}
}
],
"modified": "2026-10-25T01:05:26.531593812Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-201",
"desc": "Information Exposure Through Sent Data"
},
"URL": "https://curl.se/docs/CVE-2023-46218.json",
"www": "https://curl.se/docs/CVE-2023-46218.html",
"award": {
"amount": "2540",
"currency": "USD"
},
"issue": "https://hackerone.com/reports/2212193",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "8.4.0"
}
},
"related_cves": [
{
"value": "CVE-2023-46218",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444388,
"published_at": "2023-12-06T08:00:00+00:00"
}