CVE-2022-32205: Set-Cookie denial of service
What the report claims
Curl fails to limit the number of cookies that can be set by a single host/domain, leading to denial of service via memory exhaustion.
Compare with curl's recorded outcome
Known vulnerability
A real vulnerability: CVE-2022-32205 Set-Cookie denial of service
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
The available evidence does not settle the report. A maintainer should investigate.
Why this finding?
- The report describes a plausible DoS via unbounded domain cookies exceeding the 1 MB DYN_HTTP_REQUEST buffer.
- However, the critical cookie handling code (parsing, storage, domain matching, request header assembly) is not among the provided source snippets.
- Without that code, none of the six claims can be confirmed or contradicted.
What still needs checking
- Cookie parsing and storage implementation (likely lib/cookie.c or similar).
- Dynamic buffer (dynbuf) usage when building the Cookie request header.
- Any existing per-domain or total cookie count/size limits.
How this analysis ran 6 claims · 0 citations verified
Checked against curl master on 2022-05-13 (d56270cb308e). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
Thank you for the detailed report. To evaluate the claims, we need to see curl's cookie handling code: the Set-Cookie parser, the cookie jar storage, domain matching logic, and how cookies are serialized into the request header buffer (DYN_HTTP_REQUEST). Could you point to the relevant files or provide those files/functions, or we can fetch, the cookie implementation files at revision d56270cb308e?
Inspect all claims and source code 6 claims · 1 code excerpts
Report claims
curl fails to limit the number of cookies that can be set by a single host/domain
Read the reasoning
The claim that curl fails to limit cookies per host/domain requires examining cookie storage and domain-matching code (e.g., cookie parsing, cookie jar limits). The provided source only shows DYN_HTTP_REQUEST definition; cookie handling files are not included.
The request inhabits other headers as well as the cookies, so the amount of storage available for the cookies also varies per request
Read the reasoning
This claim about request buffer composition varying per request needs the HTTP request building code (dynbuf usage, header assembly). Not provided.
Denial of service via instant CURLE_OUT_OF_MEMORY when DYN_HTTP_REQUEST memory is exceeded
Read the reasoning
While DYN_HTTP_REQUEST (1 MB) and CURLE_OUT_OF_MEMORY exist (confirmed by deterministic checks), the code path that enforces the limit and returns CURLE_OUT_OF_MEMORY when building a request with many cookies is not in the provided snippets.
Any host in a given domain can target any other hosts in the same domain by using domain cookies
Read the reasoning
Domain cookie behavior (one host setting cookies for the whole domain) depends on curl's cookie domain-matching implementation. The relevant parsing and matching code is not provided.
The attack works from both HTTP and HTTPS and from unprivileged ports
Read the reasoning
HTTP and HTTPS symbols exist in curl (confirmed), but the claim that the attack works over both protocols and from unprivileged ports is a network-level assertion not decidable from the provided code.
Set-Cookie header with 256 entries each containing a 4092-byte value causes memory exhaustion
Read the reasoning
The specific memory exhaustion from 256 Set-Cookie headers with 4092-byte values requires the Set-Cookie parsing, cookie storage, and request serialization code. None of those files are in the provided source.
Read the original report
Source code
| 77 | #define DYN_HTTP_REQUEST (1024*1024) |