curl 8.22 Fixes a Public-Suffix Cookie Scope Error

The curl project published CVE-2026-82209 on September 2, 2026. In affected builds with Public Suffix List support, a cookie set by a host that is itself a public suffix could be stored with wildcard domain scope instead of being constrained to that exact host. A later request or redirect to a sibling subdomain could then include the cookie.

curl rates the issue low severity because exploitation requires the public-suffix apex to issue the cookie and the client to later contact a sibling. Even so, the fix is operationally relevant to web collection systems that persist cookie jars, follow redirects, reuse workers, and rotate proxy exits across many destinations.

What the advisory says

The affected range is curl 7.46.0 through 8.21.0 when libpsl support is enabled. curl 8.22.0 and later contain the fix. The behavior is reachable through both libcurl applications and the curl command-line tool.

The edge case involves a Set-Cookie response whose Domain attribute explicitly equals an origin host that is itself listed as a public suffix. The correct behavior is to constrain the cookie to the exact host. The affected behavior could save it with a leading-dot, domain-wide scope, making it eligible for sibling subdomains beneath that suffix.

This is not a claim that ordinary registrable-domain cookies are unsafe, nor that a proxy can invent the condition. The risk depends on the cookie response, PSL-aware parsing, subsequent destinations, and the lifetime of the client cookie jar.

Why proxy automation teams should care

A proxy exit is a transport property. A cookie is application state. Rotating the exit IP does not reset cookie scope, undo redirects, or separate tenants. If a shared worker carries a permissive cookie into the next job, the network route can change while the application identity remains contaminated.

The highest-value review targets are systems that:

• crawl many unrelated hostnames with a persistent cookie jar;
• follow redirects automatically across host boundaries;
• share libcurl handles or cookie files among workers;
• rotate countries or residential sessions without resetting application state;
• treat an exit-IP change as equivalent to a fresh browser session;
• build libcurl with libpsl but do not inventory its runtime version.

Step 1: confirm the runtime, not just the package label

Record the curl and libcurl versions actually loaded in every runtime. Include containers, serverless functions, desktop utilities, scheduled jobs, CI runners, and vendor applications. Also confirm whether the build reports Public Suffix List support.

Do not assume that updating the curl binary updates every application. A service may dynamically link a different libcurl, while a static binary may retain an older copy after the host package changes.

Your inventory should map each runtime to its cookie mode, redirect policy, proxy configuration, deployment owner, and restart procedure. That turns an advisory into a bounded upgrade task instead of a vague fleet-wide concern.

Step 2: upgrade and retire stale state

Upgrade affected clients to curl 8.22.0 or later. If a rebuild cannot happen immediately, use the official patch or disable Cookie use for the affected workflow until remediation is complete.

After upgrading, decide how to handle cookie jars created by older clients. For anonymous collection, replacing them is usually simpler than attempting to prove every stored scope is safe. For authenticated workflows, use a risk-based invalidation plan that respects session ownership and avoids unexpected account lockouts.

Restart or drain long-running workers so the corrected library is actually loaded. Version evidence collected before a restart is not sufficient proof of runtime remediation.

Step 3: partition cookies independently from proxy sessions

Define a cookie partition key that reflects the application trust boundary. A useful key can include tenant, account, target registrable domain, environment, and authentication purpose. Keep that key separate from the proxy-session key.

For example, two jobs may intentionally share a sticky residential exit while requiring separate Cookie jars. Conversely, one authenticated session might change approved exits but still needs a single, tightly controlled Cookie jar. Coupling both concepts creates accidental state sharing.

Review the transport/session distinction with the residential proxy session stickiness test, and verify unexpected direct routes with the proxy bypass audit.

Step 4: build a controlled domain-boundary regression

Test only domains and subdomains you control. Create a fixture whose hostname and PSL behavior can be modeled safely, then issue a response that exercises the exact Domain edge case. Use synthetic Cookie names and values with no production meaning.

A strong test sequence is:

1. start with a new process and an empty temporary Cookie jar;
2. request the controlled HTTPS origin through the intended proxy path;
3. capture Cookie metadata without recording the value;
4. inspect whether the cookie is host-only or domain-scoped;
5. request an authorized sibling host and assert that the cookie is absent;
6. repeat after a redirect, worker restart, and jar reload;
7. repeat with direct, fixed-proxy, and rotating-proxy routes;
8. destroy the temporary fixture after the test.

The test should fail closed. A missing assertion, unavailable PSL database, unexpected redirect, or unknown libcurl build must produce an explicit failure rather than a silent pass.

Step 5: test redirects and retries as separate boundaries

Cookie exposure may happen after the original response, so validate the full request graph. Record the initial host, redirect target, effective URL, scheme, Cookie-domain decision, proxy route, and retry reason for each hop.

Reject retries that silently switch from proxy to direct mode or expand the allowed destination set. Cap retry attempts and avoid carrying a Cookie jar into a job with a different trust key. When failures persist, assemble a bounded and redacted proxy support escalation packet instead of increasing retries.

Step 6: monitor metadata without leaking credentials

Useful telemetry includes the client version, PSL support state, cookie host-only flag, normalized domain, redirect boundary, worker identifier, and policy decision. It should not include Cookie values, authorization headers, passwords, proxy credentials, or raw session tokens.

Create alerts for a cookie accepted at a public-suffix boundary, a cross-partition jar reuse, a redirect to an unapproved sibling, or a worker that reports an old libcurl version after the rollout deadline.

Deployment checklist

• [ ] curl and libcurl runtime versions are inventoried across every workload.
• [ ] Public Suffix List support is known for each build.
• [ ] Affected clients are upgraded to 8.22.0 or later.
• [ ] Long-running workers are restarted or drained.
• [ ] Legacy Cookie jars are invalidated or reviewed using a documented rule.
• [ ] Cookie partition keys are independent of proxy-session keys.
• [ ] Redirects and retries enforce destination and route allowlists.
• [ ] Controlled sibling-domain tests pass for direct and proxy paths.
• [ ] Logs contain Cookie metadata only, never Cookie values.
• [ ] Failures stop the workflow rather than widening scope or bypassing the proxy.

FAQ

Does changing the proxy IP prevent this issue?

No. Proxy rotation changes transport routing, while the Cookie jar remains client-side application state. Remediation requires a fixed client and correct state partitioning.

Is every curl build affected?

The advisory describes affected versions from 7.46.0 through 8.21.0 when libpsl support is enabled. Confirm the features and runtime version of the actual build in use.

Should we disable Public Suffix List support?

The preferred response is to upgrade. PSL enforcement is an important Cookie boundary control; removing it broadly can create different risks. If you need a temporary mitigation, evaluate it narrowly and document the tradeoff.

Can we test this against arbitrary public domains?

No. Use controlled domains and synthetic sessions. Do not send crafted cookies or automated requests to systems you do not own or have permission to test.

Source and responsible-use note

Internal research basis: curl Project Security Advisory, “domain-scoped PSL domain cookie,” CVE-2026-82209, published September 2, 2026. The research URL is retained in the internal operations record; this public article contains no external links.

Operate proxy and data-collection systems only on authorized targets. Follow site terms, privacy requirements, robots directives, data-protection laws, and reasonable request rates. Do not use proxy infrastructure to bypass access controls, authentication, or geographic restrictions.