When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 3.7 · haxx, netapp, appleNVD modified 2026-10-14 18:17
Affected (CPE criteria) 14
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*
References 21
- http://seclists.org/fulldisclosure/2023/Jan/20 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/21 Mailing List, Third Party Advisory
- https://hackerone.com/reports/1613943 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220930-0005/ Third Party Advisory
- https://support.apple.com/kb/HT213603 Third Party Advisory
- https://support.apple.com/kb/HT213604 Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/20 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2023/Jan/21 Mailing List, Third Party Advisory
- https://hackerone.com/reports/1613943 Exploit, Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/01/msg00028.html Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202212-01 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220930-0005/ Third Party Advisory
- https://support.apple.com/kb/HT213603 Third Party Advisory
- https://support.apple.com/kb/HT213604 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-419740.html
- https://cert-portal.siemens.com/productcert/html/ssa-558014.html
- https://cert-portal.siemens.com/productcert/html/ssa-892048.html
- https://cert-portal.siemens.com/productcert/html/ssa-942865.html