A subtle bug in libcurl’s handle-duplication logic can let an attacker plant cookies into a running process under a narrow set of conditions — a reliability bug that turned into a security issue and was assigned CVE‑2023‑38546. The flaw is small in scope, rated low severity by the curl project...