CVE-2022-27779: Haxx Curl

Medium severity, CVSS 5.3. EPSS: 2.7% chance of exploitation in the next 30 days.

libcurl wrongly allows cookies to be set for Top Level Domains (TLDs) if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's "cookie engine" can bebuilt with or without [Public Suffix List](https://publicsuffix.org/)awareness. If PSL support not provided, a more rudimentary check exists to atleast prevent cookies from being set on TLDs. This check was broken if thehost name in the URL uses a trailing dot.This can allow arbitrary sites to set cookies that then would get sent to adifferent and unrelated site or domain.

Affected products

• Haxx Curl: from 7.82.0, before 7.83.1 (fixed in 7.83.1)
• Netapp Clustered Data Ontap: affected versions not specified
• Netapp h300s Firmware: affected versions not specified
• Netapp h410s Firmware: affected versions not specified
• Netapp h500s Firmware: affected versions not specified
• Netapp h700s Firmware: affected versions not specified
• Netapp Hci Bootstrap OS: affected versions not specified
• Netapp Hci Compute Node: affected versions not specified
• Netapp Solidfire, Enterprise Sds & Hci Storage Node: affected versions not specified
• Netapp Solidfire & Hci Management Node: affected versions not specified
• Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2022-06-02. Last modified 2026-06-17.