CVE intelligence

CVE-2026-82209

Vulnerability intelligence

Published Sep 6, 2026Sources checked Oct 28, 2026

8.2HIGHCVSS out of 10

What this means

Review the available evidence

CVE-2026-82209 and is rated High severity with a CVSS score of 8.2. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

What to do next

Remediation and response

Ubuntu Security Notices guidance

Vendor revision: Sep 24, 2026

This issue was previously fixed in USN-8487-1, but that fix was incomplete for Ubuntu 16.04 LTS.

Microsoft Security Response Center guidance

Vendor revision: Sep 9, 2026

See the Microsoft Security Update Guide for the update that applies to your product.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.4%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-82209?

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`).

Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

Source: NVD