Medium severity6.5NVD Advisory· Published Dec 7, 2023· Updated May 12, 2026
CVE-2023-46218
CVE-2023-46218
Description
This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains.
It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with domain=co.UK when the URL used a lower case hostname curl.co.uk, even though co.uk is listed as a PSL domain.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
41- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
- osv-coords37 versionspkg:apk/chainguard/curlpkg:apk/chainguard/curl-devpkg:apk/chainguard/curl-docpkg:apk/chainguard/curl-oci-entrypointpkg:apk/chainguard/curl-staticpkg:apk/chainguard/libcurl4pkg:apk/chainguard/libcurl-openssl4pkg:apk/wolfi/curlpkg:apk/wolfi/curl-devpkg:apk/wolfi/curl-docpkg:apk/wolfi/curl-oci-entrypointpkg:apk/wolfi/curl-staticpkg:apk/wolfi/libcurl4pkg:apk/wolfi/libcurl-openssl4pkg:rpm/almalinux/curlpkg:rpm/almalinux/curl-minimalpkg:rpm/almalinux/libcurlpkg:rpm/almalinux/libcurl-develpkg:rpm/almalinux/libcurl-minimalpkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.4pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%2015.5pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%20Micro%205.3pkg:rpm/opensuse/curl&distro=openSUSE%20Leap%20Micro%205.4pkg:rpm/opensuse/curl&distro=openSUSE%20Tumbleweedpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP1-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.2pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.3pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Micro%205.5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP4pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP1-LTSSpkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP1pkg:rpm/suse/curl&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5
< 8.5.0-r0+ 36 more
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 8.5.0-r0
- (no CPE)range: < 7.76.1-26.el9_3.3
- (no CPE)range: < 7.76.1-26.el9_3.3
- (no CPE)range: < 7.76.1-26.el9_3.3
- (no CPE)range: < 7.76.1-26.el9_3.3
- (no CPE)range: < 7.76.1-26.el9_3.3
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.5.0-1.1
- (no CPE)range: < 7.60.0-150000.56.1
- (no CPE)range: < 7.66.0-150200.4.63.1
- (no CPE)range: < 7.66.0-150200.4.63.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-150400.5.36.1
- (no CPE)range: < 8.0.1-11.80.1
- (no CPE)range: < 7.60.0-150000.56.1
- (no CPE)range: < 8.0.1-11.80.1
- (no CPE)range: < 7.60.0-150000.56.1
- (no CPE)range: < 8.0.1-11.80.1
Patches
Vulnerability mechanics
References
11- curl.se/docs/CVE-2023-46218.htmlnvdPatchVendor Advisory
- hackerone.com/reports/2212193nvdExploitIssue TrackingPatchThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3ZX3VW67N4ACRAPMV2QS2LVYGD7H2MVE/nvdMailing ListThird Party Advisory
- cert-portal.siemens.com/productcert/html/ssa-082556.htmlnvd
- cert-portal.siemens.com/productcert/html/ssa-093430.htmlnvd
- cert-portal.siemens.com/productcert/html/ssa-202008.htmlnvd
- cert-portal.siemens.com/productcert/html/ssa-331112.htmlnvd
- lists.debian.org/debian-lts-announce/2023/12/msg00015.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UOGXU25FMMT2X6UUITQ7EZZYMJ42YWWD/nvd
- security.netapp.com/advisory/ntap-20240125-0007/nvd
- www.debian.org/security/2023/dsa-5587nvd
News mentions
0No linked articles in our index yet.