CVE-2022-27779

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-02 · updated 2026-10-14
Weakness: CWE-201

Description

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

Affected products

curl: from 7.82.0 before 7.83.1 — fixed in 7.83.1
Clustered Data ONTAP: all versions
NetApp H300S Firmware: all versions
NetApp H410S Firmware: all versions
NetApp H500S Firmware: all versions
NetApp H700S Firmware: all versions
NetApp Hci Bootstrap Os: all versions
NetApp Hci Compute Node: all versions
NetApp Solidfire, Enterprise Sds & Hci Storage Node: all versions
NetApp Solidfire & Hci Management Node: all versions
Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: curl 7.83.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-27779 or the next vulnerability affects your stack