TI-2023-24845 Aliases CVE-2023-46218 GHSA-59mm-6rr4-j9p2

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then…

HIGH 68CWE-178Published 2023-12-07 · Updated 2026-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 16 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise allowed or possible. This allows a site to set cookies that then would get sent to different and unrelated sites and domains. It could do this by exploiting a mixed case flaw in curl's function that verifies a given cookie domain against the Public Suffix List (PSL). For example a cookie could be set with `domain=co.UK` when the URL used a lower case hostname `curl.co.uk`, even though `co.uk` is listed as a PSL domain.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.01685 77th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial curl (curl): 7.46.0Red Hat: 12 advisoriesRed Hat: 16 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
curl	curl	8.4.0 – 8.4.0	7.46.0	Patch available	CNA

curl Vendorcurl Affected 8.4.0 – 8.4.0 Fixed in 7.46.0 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:curl::::::::	7.46.0 – 8.4.0	Vulnerable	Haxx
cpe:2.3:o:fedoraproject:fedora:39:::::::*	39	Vulnerable	Fedoraproject

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.46.0 – 8.4.0 Vulnerable ·Haxx
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject

Remediation

Fix · CNA curl (curl) Fixed in 7.46.0

Red Hat 12 advisories

RHSA-2024:2092 Released 2024-05-01 · Red Hat rating Moderate
security update Logging for Red Hat OpenShift - 5.6.18
- RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
RHSA-2024:2094 Released 2024-05-01 · Red Hat rating Moderate
security update Logging for Red Hat OpenShift - 5.8.6
- RHOL 5.8 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/elasticsearch-operator-bundle +14
RHSA-2024:2093 Released 2024-05-01 · Red Hat rating Moderate
security update Logging for Red Hat OpenShift - 5.7.13
- RHOL 5.7 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15

Show 9 more Red Hat advisories

RHSA-2024:1601 Released 2024-04-02 · Red Hat rating Moderate
curl security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-33.el8_9.5, libcurl-7.61.1-33.el8_9.5, libcurl-devel-7.61.1-33.el8_9.5 +1
RHSA-2024:1383 Released 2024-03-19 · Red Hat rating Important
Red Hat OpenShift Data Foundation 4.15.0 security, enhancement, & bug fix update
- RHODF 4.15 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +23
RHSA-2024:1316 Released 2024-03-18 · Red Hat rating Moderate
Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-8.6.0-3.el7jbcs, jbcs-httpd24-httpd-2.4.57-9.el7jbcs, jbcs-httpd24-httpd-devel-2.4.57-9.el7jbcs +15
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-8.6.0-3.el8jbcs, jbcs-httpd24-httpd-2.4.57-9.el8jbcs, jbcs-httpd24-httpd-devel-2.4.57-9.el8jbcs +15
RHSA-2024:1317 Released 2024-03-18 · Red Hat rating Moderate
Red Hat JBoss Core Services Apache HTTP Server 2.4.57 SP3 security update
- Red Hat JBoss Core Services
RHSA-2024:1129 Released 2024-03-05 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-26.el9_3.3
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-26.el9_3.3, curl-minimal-7.76.1-26.el9_3.3, libcurl-7.76.1-26.el9_3.3 +1
RHSA-2024:0585 Released 2024-01-30 · Red Hat rating Moderate
curl security and bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) curl-7.61.1-30.el8_8.9, libcurl-7.61.1-30.el8_8.9, libcurl-devel-7.61.1-30.el8_8.9 +1
RHSA-2024:0434 Released 2024-01-25 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) libcurl-devel-7.76.1-14.el9_0.11
- Red Hat Enterprise Linux BaseOS EUS (v.9.0) curl-7.76.1-14.el9_0.11, curl-minimal-7.76.1-14.el9_0.11, libcurl-7.76.1-14.el9_0.11 +1
RHSA-2024:0452 Released 2024-01-25 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) libcurl-devel-7.76.1-23.el9_2.6
- Red Hat Enterprise Linux BaseOS EUS (v.9.2) curl-7.76.1-23.el9_2.6, curl-minimal-7.76.1-23.el9_2.6, libcurl-7.76.1-23.el9_2.6 +1
RHSA-2024:0428 Released 2024-01-25 · Red Hat rating Moderate
curl security and bug fix update
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) curl-7.61.1-22.el8_6.12, libcurl-7.61.1-22.el8_6.12, libcurl-devel-7.61.1-22.el8_6.12 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Satellite 6	Affected	No fix yet
RHODF 4.15 for RHEL 9	Fixed	RHSA-2024:1383
RHOL 5.6 for RHEL 8	Fixed	RHSA-2024:2092
RHOL 5.7 for RHEL 8	Fixed	RHSA-2024:2093
RHOL 5.8 for RHEL 9	Fixed	RHSA-2024:2094
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2024:1129
Red Hat Enterprise Linux AppStream EUS (v.9.0)	Fixed	RHSA-2024:0434
Red Hat Enterprise Linux AppStream EUS (v.9.2)	Fixed	RHSA-2024:0452
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2024:1601
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2024:1129
Red Hat Enterprise Linux BaseOS EUS (v.8.6)	Fixed	RHSA-2024:0428
Red Hat Enterprise Linux BaseOS EUS (v.8.8)	Fixed	RHSA-2024:0585
Red Hat Enterprise Linux BaseOS EUS (v.9.0)	Fixed	RHSA-2024:0434
Red Hat Enterprise Linux BaseOS EUS (v.9.2)	Fixed	RHSA-2024:0452
Red Hat JBoss Core Services	Fixed	RHSA-2024:1317
Red Hat JBoss Core Services on RHEL 7 Server	Fixed	RHSA-2024:1316
Red Hat JBoss Core Services on RHEL 8	Fixed	RHSA-2024:1316

Not affected: 4 products

Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
Red Hat JBoss Core Services on RHEL 7 Server
Red Hat JBoss Core Services on RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2023-46218
2026-10-03 Alias added: GHSA-59mm-6rr4-j9p2
2026-10-09 Fix available: RHSA-2024:1317 · Red Hat
2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat

References

Other 4

TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8

See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences