Cyber Resilience

CVE-2023-46218

Haxx Curl 7.46.0 – 8.4.0

Public PoC
Published
07 December 2023
Modified
12 May 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.017 75th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2023-46218 is a medium-severity Improper Handling of Case Sensitivity (CWE-178) vulnerability in Haxx Curl. Its CVSS base score is 6.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Masquerading (T1036); ranked in the top 25% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent…

more

to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.

CWE(s)
NVD-CWE-noinfoCWE-178

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-46219Same product: Fedoraproject Fedora
CVE-2026-3784Same product: Haxx Curl
CVE-2026-1965Same product: Haxx Curl
CVE-2026-5773Same product: Haxx Curl
CVE-2026-8404Shared CWE-178
CVE-2026-32939Shared CWE-178
CVE-2024-38820Shared CWE-178
CVE-2025-4035Shared CWE-178
CVE-2024-5699Shared CWE-178
CVE-2026-70429Shared CWE-178

Affected Assets

haxx
curl
7.46.0 — 8.4.0
fedoraproject
fedora
39

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
prevents

Secure SDLC practices can catch and prevent case-sensitivity flaws during code review or testing, but fixing one CWE achieves negligible coverage of the broad control.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices should include case-sensitivity requirements in design and coding standards.

A.8.26 Application security requirements partial match
prevents

Application security requirements must specify case handling for identifiers and paths.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Architecture principles should enforce canonical, case-aware resource naming.

A.8.28 Secure coding partial match
prevents

Secure coding guidelines must mandate explicit case handling to prevent inconsistent lookups.

A.8.3 Information access restriction partial match
degrades

Access-control rules that ignore case can allow unintended resource access.

A.8.5 Secure authentication partial match
degrades

Authentication logic must treat identifiers consistently to avoid bypass via case differences.

References