Improper Input Validation

AsyncHttpClient is vulnerable to Improper Input Validation. The vulnerability is due to failure to reject public suffixes in cookie Domain attributes, which allows an attacker controlling a host beneath a public suffix to inject or overwrite cookies shared across unrelated hosts, potentially...

GHSA-F9M8-CV68-674W AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Impact The cookie store decides whether a Domain attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a Domain that is...

AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

Impact The cookie store decides whether a Domain attribute may be accepted using only the domain-matching rule of RFC 6265 Section 5.1.3, which asks whether the request host is the domain or ends with a dot followed by it. Section 5.3 step 5, which additionally requires rejecting a Domain that is...

DEBIAN-CVE-2026-107280

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

CVE-2026-107280

The AsyncHttpClient (AHC) library for Java applications is vulnerable to a cookie injection or overwriting issue in versions prior to 3.0.13 and 2.16.1 . The root cause is that the ThreadSafeCookieStore component validates Domain attributes using domain matching but fails to reject public suffixe...

CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

CVE-2026-107280 AsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.uk

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such ...

AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal (ALMALINUX9.2:CLSA-2024:1712672068)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1712672068 advisory. - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed back to more origins than what is otherwise...

CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789899321)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789899321 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles,...

CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1789899988)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1789899988 advisory. - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other...

CVE-2026-101278

A flaw was found in OpenDMARC. A remote attacker can supply manipulated domain names to trigger an origin validation error when processing wildcard entries in the Public Suffix List PSL. This flaw affects the domain extraction routine and may allow an attacker to bypass domain verification checks...

curl: curl: Cookie injection via malicious HTTP server using super cookies

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...

Important: curl

Issue Overview: When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

curl: curl: Cookie injection via malicious HTTP server using super cookies

A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to...

EulerOS Virtualization 2.12.1 : curl (EulerOS-SA-2026-3580)

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check...

Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain

When processing a Set-Cookie from a response, the CookieJar client middleware trusts the server-supplied Domain attribute verbatim, with no check that it domain-matches the host that sent the cookie RFC6265 §5.3 step 6 and no public suffix check. A malicious or compromised server can therefore...

Astra Linux – Vulnerability in curl

This flaw allows a malicious HTTP server to set “super cookies” using curl, which are then transmitted back to multiple origins beyond what is allowed or possible. This enables a site to set cookies that are then sent to different and unrelated sites and domains. The attack exploits a flaw in...

AZL-99825 CVE-2026-82209 affecting package rust 1.75.0-30

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...

CVE-2026-82209

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix e.g., Domain=co.uk set by co.uk. Instead of coercing it into a strict...