CVE-2026-82209
ADVISORY - nistSummary
When libpsl support is enabled, libcurl fails to enforce the Public Suffix
List boundary check when processing a Set-Cookie header where the Domain
attribute explicitly matches an origin host that is itself a public suffix
(e.g., Domain=co.uk set by co.uk).
Instead of coercing it into a strict host-only cookie, libcurl saves the
cookie with wildcard domain scope (.co.uk). Consequently, the cookie is
inappropriately included in subsequent outbound requests or HTTP redirects to
arbitrary sibling subdomains under the same public suffix (e.g.,
attacker.co.uk).
EPSS Score: 0.00373 (0.293)
Common Weakness Enumeration (CWE)
ADVISORY - nist
Insertion of Sensitive Information Into Sent Data
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-82209
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.24 | <8.22.0-r0 | 8.22.0-r0 |
| alpine/curl | apk | alpine | edge | <8.22.0-r0 | 8.22.0-r0 |
| alpine/curl | apk | alpine | 3.22 | <=7.50.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.50.2-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.50.3-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.51.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.52.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.53.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.53.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.54.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.55.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.56.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.57.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.59.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.60.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.61.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.61.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.62.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.64.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.65.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.66.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r3 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <8.22.0-r0 | 8.22.0-r0 |
Severity and metrics
No CVSS data available from this advisory.
NIST
CREATED
UPDATED
ADVISORY IDCVE-2026-82209
EXPLOITABILITY SCORE
3.9
EXPLOITS FOUND
COMMON WEAKNESS ENUMERATION (CWE)
CVSS SCORE
8.2highDebian
CREATED
UPDATED
ADVISORY IDCVE-2026-82209
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-82209
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AmediumChainguard
CREATED
UPDATED
ADVISORY ID
CGA-r98j-6cpp-hxmx
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Photon
CREATED
UPDATED
ADVISORY ID
CVE-2026-82209
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
8.2highminimos
CREATED
UPDATED
ADVISORY ID
MINI-448j-982p-vm89
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-fg58-fw8h-j8r3
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-