A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. The attacker can inject cookies that curl scopes and transmits to unrelated third‑party domains, effectively bypassing the public‑suffix list mechanism (CWE‑565). The description of the issue has been revised, but the fundamental impact remains the same: potential exposure or modification of data carried in these cookies.

All installations of the curl client that have not applied the recent patch are affected. The CNA lists only the generic 'curl:curl' product without version constraints, meaning any instance of curl prior to the fix remains vulnerable. Administrators should confirm the presence of the update in their environment.

The CVSS score of 9.1 indicates high severity. The EPSS score of less than 1% shows a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is remote: an attacker hosts a malicious HTTP server that issues traffic with a crafted cookie header. Any curl client that performs a request to that server will store and later forward the super cookie to other domains, potentially leaking sensitive data. The attack requires no special privileges or software on the client side beyond the presence of curl.