PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-46218 Fedoraproject CVE debrief

CVE-2023-46218 is a curl cookie-handling flaw that can let a malicious HTTP server set "super cookies" by bypassing Public Suffix List checks when the cookie domain case differs from the host case. That can cause cookies to be returned to unrelated origins and domains, creating unintended cross-site cookie exposure. NVD rates the issue CVSS 3.1 6.5 (MEDIUM).

Vendor
Fedoraproject
Product
Unknown
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Teams running curl/libcurl in clients, automation, proxies, containers, or embedded software that accepts cookies from untrusted HTTP servers should pay attention. Package maintainers and fleet managers should also track downstream curl updates from distro advisories.

Technical summary

The supplied advisory text and NVD record describe a mixed-case flaw in curl's cookie domain verification against the Public Suffix List (PSL). In the example given, a cookie with domain=co.UK could be accepted when the request host is lowercase curl.co.uk, even though co.uk is a PSL entry. NVD lists affected curl versions from 7.46.0 through 8.4.0 inclusive. The practical effect is weakened origin scoping for cookies, which can lead to cross-origin cookie disclosure or replay to unrelated sites.

Defensive priority

Medium: the issue is network-reachable, requires no authentication, and can affect confidentiality and integrity of cookie isolation, but it does not indicate availability impact in the supplied data.

Recommended defensive actions

  • Apply the curl or distro package update that contains the vendor fix referenced by the curl advisory.
  • Inventory systems and applications that use curl/libcurl cookie handling, especially when contacting untrusted HTTP servers.
  • If patching is delayed, reduce or disable cookie acceptance for untrusted origins and review any assumptions about PSL-based domain scoping.
  • Check downstream advisories from Debian, Fedora, and other vendors for packaged remediation guidance and update windows.

Evidence notes

This debrief is based on the supplied NVD record and the linked curl vendor advisory. The source description explicitly says the flaw can allow a malicious HTTP server to set cookies that are then passed to more origins than intended. NVD provides the affected version range (7.46.0 through 8.4.0) and CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The CVE publication date used here is 2023-12-07; the 2026-05-12 modified timestamp is treated only as metadata context.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-46218 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-46218

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-46218 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-46218

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.