Servers and applications
CVE-2022-27779
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check…
- Severity
- Medium 5.3
- Published
- 2 Jun 2022
- Last changed
- 14 Oct 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 7.83.1
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
curlServers and applications · cpe:a:haxx:curl |
|