CVE-2026-8924 Details
Description
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
A vulnerability in curl's cookie parsing allows malicious HTTP servers to set 'super cookies' that evade Public Suffix List (PSL) checks. This lets an attacker-controlled origin inject cookies that curl later sends to unrelated third-party domains. The issue arises when a cookie is set for a domain using a trailing dot, which is not properly handled by curl's PSL support. As a result, cookies can be incorrectly scoped and transmitted to other domains under the same suffix, potentially leading to cross-site cookie injection or unintended cookie disclosure.
Users can upgrade to curl version 8.21.0 or apply the patch available in the curl GitHub repository. It is also recommended to avoid using trailing dots in hostnames.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://hackerone.com/reports/3733905 | CISA-ADP | ExploitIssue TrackingThird Party Advisory |
| https://curl.se/docs/CVE-2026-8924.html | curl | PatchVendor Advisory |
| https://curl.se/docs/CVE-2026-8924.json | curl | Vendor Advisory |
| https://hackerone.com/reports/3733905 | curl | ExploitIssue TrackingThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | curl |
Affected Products
| Product | Versions |
|---|---|
| haxx curl | >= 7.46.0, < 8.21.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 15, 2026 | CVE Modified | curl |
| Sep 15, 2026 | CVE Modified | CISA-ADP |
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 3, 2026 | New CVE Received | curl |