When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when
    processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is
    itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-
    only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is
    inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains
    under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1789899321 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1789899690 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790154364 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1789899988 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790152441 advisory.

  - A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share     connections with other handles, can lead to use-after-free in the cleanup process. (CVE-2026-18924)

  - When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification     (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key     pinning on connections established without a presented server certificate. Bypassing the pinning check     under these disabled-verification conditions allows unauthenticated connections to succeed when they     should be rejected. (CVE-2026-80230)

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8820-1 advisory.

    Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain     circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation.
    This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

    Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing     connections between handles. A remote attacker could possibly use this issue to cause curl to crash,     resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

    Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using     the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a     denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

    Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate     verification was disabled in certain circumstances. A remote attacker could possibly use this issue to     bypass pinning checks and cause curl to accept connections that should have been rejected.
    (CVE-2026-80230)

    Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain     circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

    Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling     cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be     sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-82209)

    Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a     handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to     obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete     for Ubuntu 16.04 LTS. (CVE-2026-8927)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when     processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is     itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-     only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is     inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains     under the same public suffix (e.g., `attacker.co.uk`). (CVE-2026-82209)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465934	Echo: curl: security update to 1:8.22.0-1+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
465934	Echo: curl: security update to 1:8.22.0-1+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
360930	CentOS Linux 8.4 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1789899321)	Nessus	CentOS Local Security Checks	Local	critical
360373	CentOS Linux 8.5 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1789899690)	Nessus	CentOS Local Security Checks	Local	critical
360071	AlmaLinux 9.2 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790154364)	Nessus	Alma Linux Local Security Checks	Local	critical
352541	CentOS Linux 8 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1789899988)	Nessus	CentOS Local Security Checks	Local	critical
352430	Rocky Linux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)	Nessus	Rocky Linux Local Security Checks	Local	critical
352406	AlmaLinux 9.6 [TuxCare] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790152441)	Nessus	Alma Linux Local Security Checks	Local	critical
350699	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8820-1)	Nessus	Ubuntu Local Security Checks	Local	critical
342420	Linux Distros Unpatched Vulnerability : CVE-2026-82209	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-82209

high

Tenable Plugins

high

high

critical

critical

critical

critical

critical

critical

critical

high