A vulnerability in libcurl enables improper cookie domain scoping, which could lead to sensitive information disclosure across sibling subdomains.

The vulnerability exists in libcurl when libpsl support is enabled, causing the software to fail to enforce Public Suffix List boundary checks for Set-Cookie headers. This allows an unauthenticated attacker to force the browser or application to save cookies with a wildcard domain scope, resulting in the unauthorized sharing of cookies with arbitrary sibling subdomains.

The exposure of session cookies or authentication tokens to unauthorized subdomains poses a significant risk of account takeover and session hijacking. Given the CVSS score of 8.2, this high-severity flaw necessitates immediate attention to prevent lateral movement or credential theft, which could severely compromise the integrity of user sessions across an entire domain infrastructure.

Immediate Action: Upgrade the affected libcurl library to a patched version as soon as the vendor makes it available, as no specific patch version is currently identified.

Proactive Monitoring: Review outbound traffic logs and HTTP response headers for anomalous cookie domain attributes that deviate from expected strict host-only scoping.

Compensating Controls: Deploy or update WAF rules to inspect and strip or sanitize Set-Cookie headers containing overly broad domain attributes originating from untrusted or public-facing endpoints.

Public Exploit Available: Unknown

This vulnerability presents a clear risk to session security and requires proactive management. Organizations should prioritize identifying all instances of the affected versions within their environment and prepare to apply security updates immediately upon release by the curl project.