curl 8.22 Fixes a Public-Suffix Cookie Boundary Bug: What Proxy Workflows Should Test

The curl project released curl 8.22.0 on September 2, 2026 and published a coordinated security advisory for CVE-2026-82209. The issue concerns cookie-domain validation when libcurl is built with Public Suffix List support. A specially scoped cookie set by a public-suffix origin could be sent to a sibling beneath that suffix in a later request.

The curl project rates the issue Low severity and states that an attacker cannot simply plant the cookie: exploitation requires the public-suffix apex to issue it, followed by a request to an attacker-controlled sibling. Affected versions are curl 7.46.0 through 8.21.0 when the relevant support is present; curl 8.22.0 contains the fix.

For proxy operators and authorized data-collection teams, the lesson is precise. A proxy route does not create this client-side cookie decision, but proxy-enabled applications often reuse libcurl handles, cookie jars, redirects, and authenticated sessions across many hosts. That makes the cookie boundary part of the workflow's security model.

What changed

HTTP cookies may include a Domain attribute that controls where a client may return them. Public suffixes are registry-level boundaries. Clients use Public Suffix List data to prevent a site at such a boundary from setting a cookie that becomes available to unrelated registrants below it.

The advisory describes a case where libcurl failed to enforce that boundary when the Domain attribute explicitly matched an origin host that was itself a public suffix. The fix restores the intended rejection behavior.

This is different from a proxy credential leak. Proxy authentication headers and destination cookies occupy different protocol scopes. Still, both can be exposed by unsafe reuse, redirects, or logging, so regression tests should keep them visibly separate.

Determine whether your application is affected

Inventory every place curl or libcurl is used, including command-line jobs, language bindings, embedded agents, container images, desktop tools, and vendor appliances. The version reported by a shell may not match the library loaded by an application.

For each runtime, record:

• the curl and libcurl version;
• whether Public Suffix List support is enabled;
• the loaded libpsl version when applicable;
• whether cookies are enabled;
• whether a shared or persistent cookie jar is used;
• which hosts may share a client handle or session;
• whether redirects can cross registrable domains.

Do not store cookie values, proxy passwords, authorization headers, or personal data in the inventory.

Upgrade, patch, or disable the risky feature

The curl project recommends upgrading to 8.22.0, applying the published patch to the maintained build, or not using cookies. Choose a supported path that fits your packaging and change-control process.

Do not assume that upgrading the operating-system package automatically updates a statically linked application or container. Rebuild the exact artifact, verify its runtime version, and retain a rollback image until the canary passes.

Build a safe cookie-isolation regression

Use only domains and subdomains you control. Do not reproduce the issue against real public-suffix infrastructure.

Create an authorized fixture with three roles:

1. a cookie-setting origin;
2. an allowed sibling inside the same registrable domain;
3. a separate control domain that must never receive the cookie.

The fixture should return a harmless marker cookie and expose only whether the marker arrived, not its value. Run the same sequence on the current build and the patched build:

1. begin with an empty in-memory cookie store;
2. request the setting origin through the intended proxy path;
3. follow only the redirects defined by the fixture;
4. request the allowed sibling;
5. request the control domain;
6. confirm which requests carried the marker;
7. repeat with connection reuse and with a new client handle.

Keep proxy routing constant so a client-security change is not confused with a network change. If the application rotates exits, pin one authorized session for the isolation test.

Test the boundaries production actually uses

A complete regression should include cookies enabled and disabled, in-memory and file-backed cookie jars, direct requests and the application's normal proxy mode, redirects within and across registrable domains, one handle and a reused pool, supported HTTP versions, IPv4 and IPv6 when both are in production, and the same wrapper used by the real job.

The pass condition is not merely “the request succeeded.” The harmless marker must appear only where policy permits, proxy credentials must never reach the destination, and the patched build must preserve expected application outcomes.

Protect diagnostics

Cookie testing can create sensitive traces. Use synthetic values, redact Cookie, Set-Cookie, Authorization, and Proxy-Authorization, and limit retention. HAR files and verbose curl output should be treated as secrets until sanitized.

The proxy diagnostic archive redaction guide provides a broader checklist. For network comparisons, use the proxy and target throttling isolation method.

Roll out with a measurable canary

Start with a small share of authorized jobs. Compare valid application outcome rate, cookie rejection and acceptance events from the fixture, redirect failures, authentication failures, p50 and p95 completion time, transferred bytes, retry rate, proxy-session continuity, and unexpected cookie-jar growth.

Stop the canary if cookie isolation fails, credentials enter logs, or the application outcome changes outside the accepted threshold. A security update still needs operational validation, but rollback should never restore an unsafe build without an explicit risk decision and compensating controls.

Verification checklist

• All curl and embedded libcurl runtimes are inventoried.
• Version and Public Suffix List support are verified at runtime.
• Cookie use, jar persistence, handle sharing, and redirects are documented.
• curl 8.22.0 or the maintained patch is deployed to a canary.
• Tests use only controlled domains and synthetic cookies.
• Expected and forbidden cookie scopes have explicit assertions.
• Direct and proxied paths are compared without changing other variables.
• Logs and traces contain no cookies, tokens, or proxy credentials.
• Application success, latency, retries, and session behavior remain acceptable.
• Final artifacts and containers report the intended patched version.

FAQ

Does the proxy provider need to fix CVE-2026-82209?

The advisory concerns curl's client-side cookie handling. A provider may operate software that embeds libcurl, but the team controlling each affected client or service must inventory and update its own runtime.

Is every curl version before 8.22.0 vulnerable?

No. The advisory identifies curl 7.46.0 through 8.21.0 as affected and notes the relevance of Public Suffix List support. Verify the exact build instead of inferring from a package name.

Does disabling cookies remove the affected path?

The curl project lists not using cookies as a mitigation. Many authenticated or stateful workflows require cookies, so upgrading or applying the patch is usually the more durable option.

Should we scan real sites for the behavior?

No. Use controlled fixtures and domains you own. Broad external scanning is unnecessary and may violate policy or law.

Compliance and source note

Use proxy and cookie tests only with systems, domains, accounts, and data you are authorized to handle. Respect destination terms, rate limits, privacy requirements, retention rules, and access controls. Do not collect real session cookies or use the issue to cross domain boundaries.

Internal research source: curl project, “domain-scoped PSL domain cookie — CVE-2026-82209,” September 2, 2026; curl project, “Changes in 8.22.0,” September 2, 2026. Source locations are retained only in the internal operations record.