Trailing dots are the worst
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
curl 8.21.0 fixed three separate bugs caused by trailing dots in hostnames. First, a trailing dot on an IPv4 address (e.g. '192.168.0.1.') caused inet_pton() to return false, incorrectly allowing wildcard TLS certificates — fixed by stripping the trailing dot during normalization. Second, double trailing dots confused the HSTS logic and are now banned entirely. Third, a trailing dot on a cookie domain bypassed the Public Suffix List check in libpsl, allowing a server to set overly broad cookies — this was assigned CVE-2026-8924. The author reflects that trailing dots have always existed and will continue to cause edge-case bugs.
Table of contents
IPv4 numerical addressDouble trailing dots HSTSCookie domainWe should consider these things1.4K Impressions