Examples / Report #3733905 Saved analysis

CVE-2026-8924: trailing dot domain super cookie

curl · 2026-05-139.6s analysis · $0.012 in model calls

What the report claims

curl incorrectly accepts a trailing-dot public suffix cookie (e.g., Domain=co.uk.) and later sends it to another trailing-dot host, while rejecting the canonical form (Domain=co.uk) without a trailing dot.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2026-8924 trailing dot domain super cookie

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

More detail needed

There is not enough information to verify the reported bug.

Why this finding?

No curl source code was provided for the revision db4a6f286bbc (master on 2026-05-13), despite deterministic checks confirming the revision exists
All claims depend on specific cookie domain matching and PSL checking logic that cannot be examined
External source E1 mentions 'cookie: trim trailing dots when checking PSL' in a commit log, suggesting related work exists, but the actual code is not available for analysis
The PoC script referenced in the report was not provided

What still needs checking

curl source code for cookie domain matching and PSL validation (likely lib/cookie.c, lib/psl.c, or similar) at revision db4a6f286bbc
The PoC script (curl_trailing_dot_psl_demo.py) to understand the exact test conditions

How this analysis ran 5 claims · 0 citations verified

Checked against curl master on 2026-05-13 (db4a6f286bbc). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 1 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 2031 tokens · $0.0002

3 · Evidence

0 code snippets

real curl source at db4a6f286bbc · 3 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

7463 tokens · 6.4s · $0.0113

5 · Receipts

0 of 0 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report. To evaluate this, we need the curl source code for the cookie domain matching and PSL validation logic at the tested revision (db4a6f286bbc). The deterministic checks confirm this revision exists but the code was not retrieved. Please provide the relevant files (likely lib/cookie.c, lib/psl.c, or similar) or confirm the revision hash so we can fetch the code. Also, sharing the PoC script would help reproduce the issue.

Inspect all claims and source code 5 claims · 0 code excerpts

Report claims

C1flaw not verifiable

curl rejects a canonical public suffix cookie such as Domain=co.uk but accepts the trailing-dot variant Domain=co.uk. when the request host also uses a trailing dot

Read the reasoning

The report claims curl rejects canonical public suffix cookies (Domain=co.uk) but accepts trailing-dot variants (Domain=co.uk.) when the request host uses a trailing dot. No curl source code was provided to verify the cookie domain matching logic or PSL checking behavior. The deterministic checks confirm the revision exists (db4a6f286bbc) but the curl_source section states 'no curl code could be retrieved for this report'. Without the relevant cookie handling code (likely in lib/cookie.c or similar), this claim cannot be verified.

C2location not verifiable

the flaw occurs in the cookie matching logic that compares the request hostname with the cookie's Domain attribute

Read the reasoning

The report locates the flaw in 'cookie matching logic that compares the request hostname with the cookie's Domain attribute'. No source code was provided to confirm this location or examine the logic.

C3trigger not verifiable

a response from a trailing-dot hostname (e.g., foo.co.uk.) sets Set-Cookie: trail=1; Domain=co.uk.; Path=/

Read the reasoning

The trigger describes a specific attack vector (trailing-dot hostname setting a trailing-dot Domain cookie). While plausible, the code path that processes Set-Cookie headers and validates Domain attributes against PSL was not provided.

C4impact not verifiable

curl later sends the cookie to another trailing-dot host (e.g., bar.co.uk.) during a redirect, causing cross-site cookie exposure

Read the reasoning

The impact claim depends on the flaw in C1 being real. Without verifying the underlying cookie matching behavior, the impact cannot be assessed.

C5reproduction not verifiable

the attached PoC script uses curl's normal cookie engine and --connect-to options to demonstrate the acceptance of the trailing-dot cookie and its subsequent transmission

Read the reasoning

The PoC script was not provided in the materials. The report describes its operation but the actual script content is unavailable for review.

What the report says about other projects

not addressed The public suffix list (PSL) defines that a domain ending with a trailing dot is not a public suffix and should be treated as a host name, not a domain for cookie setting

not addressed cookie: trim trailing dots when checking PSL

not addressed CVE-2022-27779: cookie for trailing dot TLD

Read the original report (excerpt)

Full report on HackerOne ↗

## Summary: A PSL-enabled curl build rejects a canonical public suffix cookie such as `Domain=co.uk`, but accepts the trailing-dot variant `Domain=co.uk.` when the request host also uses a trailing dot. In the reproduced case, a response from `foo.co.uk.` sets `Set-Cookie: trail=1; Domain=co.uk.; Path=/`, and curl later sends `Cookie: trail=1` to `bar.co.uk.` during the same cookie-enabled redirect flow. The canonical control case, `foo.co.uk` with `Domain=co.uk`, is rejected as expected. This suggests inconsistent public suffix handling between canonical hostnames and trailing-dot FQDN forms. ## Affected version Reproduced with: curl 8.20.0 (Debian Testing) and 8.21.0-DEV ``` curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 brotli/1.2.0 zstd/1.5.7 libidn2/2.3 .8 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.69.0 ngtcp2/1.22.1 nghttp3/1.15.0 mit-krb5/1.22.1 OpenLDAP/2.6.10 Release-Date: 2026-04-29, security patched: 8.20.0-1 Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt mqtts pop3 pop3s rtsp scp sftp smtp smtps telnet tftp ws wss Features: alt-svc AsynchDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTPS-proxy IDN IPv6 Kerberos Largefile libz PSL SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd ``` ## Steps To Reproduce: Use the attached PoC script: ```bash CURL=/path/to/curl python3 curl_trailing_dot_psl_demo.py ``` The script starts a local HTTP server and runs two curl flows. First, it runs a negative control: ```text http://foo.co.uk:<port>/start-canonical ``` The server replies with: ```http Set-Cookie: canonical=1; Domain=co.uk; Path=/ Location: http://bar.co.uk:<port>/check-canonical ``` Expected and observed result: curl does not send `canonical=1` to `bar.co.uk`. Second, it runs the trailing-dot case: ```text http://foo.co.uk.:<port>/start-trailing ``` The server replies with: ```http Set-Cookie: trail=1; Domain=co.uk.; Path=/ Location: http://bar.co.uk.:<port>/check-trailing ``` Observed result: curl sends the cookie to the second host: ```text VULNERABLE / reproduced: bar.co.uk. received Cookie: trail=1 ``` The PoC uses curl's normal cookie engine and local connection redirection only to keep the test self-contained: ```bash -b "" --connect-to foo.co.uk.:<port>:127.0.0.1:<port> --connect-to bar.co.uk.:<port>:127.0.0.1:<port> ``` ## Impact ## Summary: A malicious server r …

Source code

No source code was retrieved for this analysis. The evidence may be incomplete.