{"id":"CVE-2014-3613","aliases":["CURL-CVE-2014-3613","DEBIAN-CVE-2014-3613","DLA-64-1","DSA-3022-1","EUVD-2014-3577","GHSA-gcmw-6qh5-324w","MGASA-2014-0384","MGASA-2014-0385","RHSA-2015:1254","RHSA-2015:2159","UBUNTU-CVE-2014-3613","USN-2346-1","openSUSE-SU-2024:10303-1"],"status":"published","title":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names,...","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07145,"percentile":0.94312,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2014-09-10T00:00:00Z","modified":"2026-10-25T01:05:39Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.38.0-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"curl","fixed_in":["7.21.0-2.1+squeeze9"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"curl","fixed_in":["7.26.0-1+wheezy10"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"curl","fixed_in":["7.28.1-6.5.mga3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.38.0-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-2.1+squeeze9"}]}],"versions":["7.21.0-1","7.21.0-2","7.21.0-2.1+squeeze1","7.21.0-2.1+squeeze2","7.21.0-2.1+squeeze3","7.21.0-2.1+squeeze4","7.21.0-2.1+squeeze5","7.21.0-2.1+squeeze6","7.21.0-2.1+squeeze7","7.21.0-2.1+squeeze8"]},{"source":"osv","ecosystem":"Debian:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.26.0-1+wheezy10"}]}],"versions":["7.26.0-1+wheezy2","7.26.0-1+wheezy3","7.26.0-1+wheezy4","7.26.0-1+wheezy5","7.26.0-1+wheezy6","7.26.0-1+wheezy7","7.26.0-1+wheezy8","7.26.0-1+wheezy9"]},{"source":"osv","ecosystem":"Mageia:3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.28.1-6.5.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.34.0-1.3.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.19.7-46.el6"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-25.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.1"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.1"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"haxx","product":"curl"},{"vendor":"haxx","product":"libcurl"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20140910A.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix","web","article","report"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1254.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://kb.juniper.net/InfoCenter/index?page=content\u0026id=JSA10743","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/69748","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://support.apple.com/kb/HT205031","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3022","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3613","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gcmw-6qh5-324w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3613","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0384.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14088","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0385.html","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20140910B.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1254","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=835898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=997185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1008178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1011101","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1058767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1104160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1136154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154941","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1156422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1178692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213351","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1254.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3613","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3613","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3707","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3707","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20141105.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8150","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8150","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8150","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150108B.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3143","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150422A.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-3148","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3148","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3148","tags":["advisory"]},{"url":"http://curl.haxx.se/docs/adv_20150422B.html","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2015:2159","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1130239","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1154060","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1161182","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1166264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1170339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1218272","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_2159.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3613","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2346-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3620","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3613","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2014-11-18T15:00:00Z","modified":"2024-08-06T10:50:17.964Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3577","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2014-11-18T15:00:00Z","modified":"2024-08-06T10:50:17Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-gcmw-6qh5-324w","title":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names,...","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2022-05-14T03:59:54Z","modified":"2023-02-03T05:01:01Z","updated_at":"2026-11-02T14:52:53.87765Z"}],"nvd":[{"id":"CVE-2014-3613","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2014-11-18T15:59:00.14Z","modified":"2026-06-17T00:08:37.19Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CURL-CVE-2014-3613","title":"cookie leak with IP address as domain","description":"By not detecting and rejecting domain names for partial literal IP addresses\nproperly when parsing received HTTP cookies, libcurl can be fooled to both\nsending cookies to wrong sites and into allowing arbitrary sites to set\ncookies for others.\n\nFor this problem to trigger, the client application must use the numerical\nIP address in the URL to access the site and the site must send back cookies\nto the site using domain= and a partial IP address.\n\nSince libcurl wrongly approaches the IP address like it was a normal domain\nname, a site at IP address `192.168.0.1` can set cookies for anything ending\nwith `.168.0.1` thus fooling libcurl to send them also to for example\n`129.168.0.1`.\n\nThe flaw requires dots to be present in the IP address, which restricts the\nflaw to IPv4 literal addresses or IPv6 addresses using the somewhat unusual\n\"dotted-quad\" style: `::ffff:192.0.2.128`.\n\nThis is not believed to be done by typical sites as this is not supported by\nclients that adhere to the rules of the RFC 6265, and many sites are written\nto explicitly use their own specific named domain when sending cookies.","status":"published","published":"2014-09-10T08:00:00Z","modified":"2026-10-25T01:05:39.371906606Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2014-3613","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2014-11-18T15:59:00Z","modified":"2026-04-16T06:17:23.031195806Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3613","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2014-11-18T15:59:00.14Z","modified":"2026-10-23T15:47:24.724561931Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-64-1","title":"curl - security update","status":"published","published":"2014-09-26T00:00:00Z","modified":"2026-03-09T02:09:26.81152Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3022-1","title":"curl - security update","status":"published","published":"2014-09-10T00:00:00Z","modified":"2026-03-09T01:22:55.298564Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0384","title":"Updated curl packages fix security vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nIn cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong\nsites and into allowing arbitrary sites to set cookies for others. For this\nproblem to trigger, the client application must use the numerical IP address\nin the URL to access the site (CVE-2014-3613).\n","status":"published","published":"2014-09-24T16:44:28Z","modified":"2026-04-16T06:25:51.680705629Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0385","title":"Updated curl packages fix security vulnerabilities","description":"Updated curl packages fix security vulnerabilities:\n\nIn cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong\nsites and into allowing arbitrary sites to set cookies for others. For this\nproblem to trigger, the client application must use the numerical IP address\nin the URL to access the site (CVE-2014-3613).\n\nIn cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top Level\nDomains (TLDs), thus making them apply broader than cookies are allowed. This\ncan allow arbitrary sites to set cookies that then would get sent to a\ndifferent and unrelated site or domain (CVE-2014-3620).\n","status":"published","published":"2014-09-24T16:44:28Z","modified":"2026-04-16T06:25:03.08217585Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1254","title":"Red Hat Security Advisory: curl security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:15:39Z","modified":"2026-06-28T10:14:15Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"RHSA-2015:2159","title":"Red Hat Security Advisory: curl security, bug fix, and enhancement update","status":"published","published":"2024-09-15T22:15:45Z","modified":"2026-06-28T10:15:11Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"UBUNTU-CVE-2014-3613","description":"cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.","status":"published","published":"2014-09-10T00:00:00Z","modified":"2026-04-22T09:41:45.211923Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2346-1","title":"curl vulnerabilities","description":"Tim Ruehsen discovered that curl incorrectly handled partial literal IP\naddresses. This could lead to the disclosure of cookies to the wrong site,\nand malicious sites being able to set cookies for others. (CVE-2014-3613)\n\nTim Ruehsen discovered that curl incorrectly allowed cookies to be set\nfor Top Level Domains (TLDs). This could allow a malicious site to set a\ncookie that gets sent to other sites. (CVE-2014-3620)\n","status":"published","published":"2014-09-15T12:26:17Z","modified":"2026-04-22T09:00:09.089543Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}