# CVE-2022-32205: Set-Cookie denial of service

Malicious server floods curl with huge Set-Cookie headers; stored cookies bloat later requests past curl's 1MB limit, causing persistent DoS for sibling subdomains.

- Payout: $480
- Severity: low
- Program: Internet Bug Bounty
- Credited: nyymi
- Disclosed: 2022-06-27
- CVE: CVE-2022-32205
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1614328
- Library page: https://bugbountylibrary.com/r/h1%3A1614328
- Tags: domain:oss impact:dos kind:bounty platform:hackerone sev:low tech:curl technique:source-review vuln:dos

**Target:** curl/libcurl cookie engine (Set-Cookie handling and outgoing Cookie header)
**Root cause:** curl stored unlimited Set-Cookie headers and sent unlimited cookies per request; no cap on cookie count or outgoing Cookie header size, so accumulated cookies push requests past the internal 1048576-byte request-size threshold.
**Steps:**
1. Malicious server responds with excessive large `Set-Cookie:` headers; curl stores all of them.
2. Cookies match sibling subdomains per cookie matching rules (foo.example.com sets cookies matching bar.example.com).
3. Subsequent requests to matching hosts include all stored cookies, exceeding curl's 1048576-byte request threshold.
4. curl refuses to send and returns an error, causing persistent DoS until cookies expire/are cleared.
**How found:** Researcher reasoned about curl's internal 1MB request-size threshold (introduced with dynbuf in 7.71.0) and realized unbounded cookie storage could push outgoing requests past it; cookie domain-matching rules extended impact to sibling subdomains.
**Exploitation:** Attacker controls one subdomain (foo.example.com) and serves many large Set-Cookie headers; victim curl client stores them, and later requests to sibling bar.example.com exceed the 1MB request limit and fail, denying service for as long as cookies persist.
**Escalation:** Cross-subdomain impact via cookie matching rules: a sister server can DoS a sibling site on the same second-level domain.
**Insight:** When a client enforces a hard request-size cap, look for unbounded attacker-controlled inputs (cookies, headers) that accumulate into that cap; also check cookie domain-matching to see if one subdomain can poison requests to siblings.