CVE-2026-8924: trailing dot domain super cookie

How it was found

Summary:

A PSL-enabled curl build rejects a canonical public suffix cookie such as Domain=co.uk, but accepts the trailing-dot variant Domain=co.uk. when the request host also uses a trailing dot. In the reproduced case, a response from foo.co.uk. sets Set-Cookie: trail=1; Domain=co.uk.; Path=/, and curl later sends Cookie: trail=1 to bar.co.uk. during the same cookie-enabled redirect flow. The canonical control case, foo.co.uk with Domain=co.uk, is rejected as expected. This suggests inconsistent public suffix handling between canonical hostnames and trailing-dot FQDN forms.

Affected version

Reproduced with: curl 8.20.0 (Debian Testing) and 8.21.0-DEV

curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 brotli/1.2.0 zstd/1.5.7 libidn2/2.3
.8 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.69.0 ngtcp2/1.22.1 nghttp3/1.15.0 mit-krb5/1.22.1 OpenLDAP/2.6.10 
Release-Date: 2026-04-29, security patched: 8.20.0-1 
Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt mqtts pop3 pop3s
 rtsp scp sftp smtp smtps telnet tftp ws wss 
Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz PSL 
SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

Steps To Reproduce:

Use the attached PoC script:

CURL=/path/to/curl python3 curl_trailing_dot_psl_demo.py

The script starts a local HTTP server and runs two curl flows.

First, it runs a negative control:

http://foo.co.uk:<port>/start-canonical

The server replies with:

Set-Cookie: canonical=1; Domain=co.uk; Path=/
Location: http://bar.co.uk:<port>/check-canonical

Expected and observed result: curl does not send canonical=1 to bar.co.uk.

Second, it runs the trailing-dot case:

http://foo.co.uk.:<port>/start-trailing

The server replies with:

Set-Cookie: trail=1; Domain=co.uk.; Path=/
Location: http://bar.co.uk.:<port>/check-trailing

Observed result: curl sends the cookie to the second host:

VULNERABLE / reproduced: bar.co.uk. received Cookie: trail=1

The PoC uses curl's normal cookie engine and local connection redirection only to keep the test self-contained:

-b ""
--connect-to foo.co.uk.:<port>:127.0.0.1:<port>
--connect-to bar.co.uk.:<port>:127.0.0.1:<port>

Impact

Summary:

A malicious server reached through a trailing-dot hostname may be able to set a cookie for a trailing-dot public suffix form, such as co.uk., that curl later sends to another trailing-dot host under the same suffix. This can cause cross-site cookie injection or unintended cookie disclosure between otherwise unrelated hosts. The impact depends on an application using curl/libcurl with cookies enabled and making requests to trailing-dot hostnames. Practical exposure is narrower than a general public suffix bypass, but the behavior appears inconsistent with curl's PSL-based rejection of canonical public suffix cookies.