CVE-2022-27779: haxx curl
Vulnerability summary
CVE-2022-27779 is a medium (CVSS 5.3) vulnerability in haxx curl. EPSS estimates a 2.79% chance of exploitation in the next 30 days, higher than 86.2% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 01-06-2022PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
2.79%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
+0.06 pp
From 2.73% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Netapp9 products
Alpine1 product
- curl≥ 7.82.0, < 7.83.1-r0
Debian1 product
- curl< 7.83.1-1
Haxx1 product
- curl≥ 7.82.0, < 7.83.1
Splunk1 product
- universal_forwarder≥ 8.2.0, < 8.2.12 | ≥ 9.0.0, < 9.0.6 | 9.1.0
5 vendors · 13 products
References
7 links- security.netapp.com/advisory/ntap-20220609-0009/Third Party Advisory
