CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided...
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
CVE-2022-27779- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-201
- Updated
- 2026-11-03
CVE List No score
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
CVE-2022-27779- Weakness
- CWE-201
- Updated
- 2026-11-02
EUVDEUVD-2022-32274 No score
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
EUVD-2022-32274- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r5c3-3mf2-x8c7
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided...
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
GHSA-r5c3-3mf2-x8c7- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-201, CWE-668
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
ALPINE-CVE-2022-27779- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSVAZL-9908
CVE-2022-27779 affecting package curl for versions less than 7.83.1-1
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
AZL-9908- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVBELL-CVE-2022-27779
CVE-2022-27779 does not affect BellSoft software
- Record
BELL-CVE-2022-27779- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
DEBIAN-CVE-2022-27779- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSVCURL-CVE-2022-27779 No score
cookie for trailing dot TLD
libcurl wrongly allows HTTP cookies to be set for Top Level Domains (TLDs) if the hostname is provided with a trailing dot.
curl can be told to receive and send cookies when communicating using HTTP(S). curl's "cookie engine" can be built with or without Public Suffix List awareness. If PSL support not provided, a more rudimentary check exists to at least prevent cookies from being set on TLDs. This check was broken if the hostname in the URL uses a trailing dot.
This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain.
- Record
CURL-CVE-2022-27779- Updated
- 2026-11-02
OSV No score
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
- Record
CVE-2022-27779- Weakness
- CWE-201
- Updated
- 2026-11-04
OSVopenSUSE-SU-2024:12062-1 No score
curl-7.83.1-1.1 on GA media
These are all security issues fixed in the curl-7.83.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12062-1- Updated
- 2026-11-02
Affected products
- haxx curl
- netapp clustered data ontap
- netapp h300s firmware
- netapp h410s firmware
- netapp h500s firmware
- netapp h700s firmware
- netapp hci bootstrap os
- netapp hci compute node
- netapp solidfire\, enterprise sds \& hci storage node
- netapp solidfire \& hci management node
- siemens simatic s7-1500 cpu 1518-4 pn/dp mfp
- siemens simatic s7-1500 cpu 1518f-4 pn/dp mfp
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
curlAlpine:v3.16 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.17 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.18 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.19 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.20 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.21 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.22 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.23 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAlpine:v3.24 |
7.82.0 up to 7.83.1-r0 | 7.83.1-r0 |
curlAzure Linux:2 |
before 7.83.1-1 | 7.83.1-1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | EUVD, NVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-27779 is a medium vulnerability (CVSS 5.3) in Haxx Curl, published May 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.79%, the 86th percentile. Fixed in curl 7.83.1-r0.
References
hackerone.com/reports/1553301
security.netapp.com/advisory/ntap-20220609-0009
security.gentoo.org/glsa/202212-01
cert-portal.siemens.com/productcert/html/ssa-398330.html
nvd.nist.gov/vuln/detail/CVE-2022-27779
github.com/advisories/GHSA-r5c3-3mf2-x8c7
Show 10 moreShow less
security.alpinelinux.org/vuln/CVE-2022-27779
docs.bell-sw.com/security/cves/CVE-2022-27779
security-tracker.debian.org/tracker/CVE-2022-27779
suse.com/security/cve/CVE-2022-27778