The vulnerability occurs when libpsl support is enabled in libcurl; the library incorrectly stores a cookie with a wildcard domain scope for a Set‑Cookie header whose Domain attribute matches a public suffix host. This results in the cookie being sent to any subdomain under the same public suffix, rather than being limited to the originating host. The unintended cookie scope can enable attackers to conduct cross‑subdomain tracking, session hijacking, or CSRF attacks by leveraging the cookie across unrelated sites that share the same public suffix.

The affected product is libcurl (the curl library) when it is compiled with libpsl support. No specific version numbers are listed, so any build of curl that includes libpsl may be impacted until the vendor releases a fix.

The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.2, indicating high severity. The known attack vector involves an attacker controlling a domain that is itself a public suffix, such as co.uk, who can set a cookie with Domain=co.uk. By doing so, the attacker can force that cookie to be sent to any subdomain of co.uk, including unrelated sites such as attacker.co.uk, which could then be used to hijack sessions or perform other cross‑domain attacks. Because the flaw requires the attacker to generate a Set‑Cookie header from a public suffix domain and it relies on libcurl's cookie handling, exploitation is considered evitable by ensuring that cookie domains are validated against the public suffix list, but no exploitation reports are currently available.