{"id":"CVE-2026-8924","title":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check","summary":"A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmit…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwe":["CWE-201","CWE-565"],"vendor":"haxx","product":"curl","affected":["curl >= 7.46.0, < 8.21.0"],"patched":["curl 8.21.0"],"published":"2026-07-03","updated":"2026-09-15","sourceUpdated":"2026-09-15T07:16:32.573","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924","references":[{"url":"https://curl.se/docs/CVE-2026-8924.html","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://curl.se/docs/CVE-2026-8924.json","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3733905","label":"2499f714-1537-4658-8207-48ae4bb9eae9"},{"url":"https://hackerone.com/reports/3733905","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8924.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-8924"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2496765"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8924"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8924"},{"url":"https://access.redhat.com/errata/RHSA-2026:29017"},{"url":"https://access.redhat.com/errata/RHSA-2026:34975"},{"url":"https://access.redhat.com/errata/RHSA-2026:56869"},{"url":"https://access.redhat.com/errata/RHSA-2026:69125"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat","score-dispute"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-07-06T16:56:31.860200Z"},"epss":0.00661,"epssPercentile":0.49825,"scores":{"nvd":9.1,"vendor":6.5},"ingestedAt":"2026-07-04T04:55:39.436Z","slug":"CVE-2026-8924","body":"## Overview\n\nA flaw in curl’s cookie parsing logic allows a malicious HTTP server to set\n\"super cookies\" that bypass the Public Suffix List check. This enables an\nattacker-controlled origin to inject cookies that curl subsequently scopes and\ntransmits to unrelated third-party domains.\n\n## Affected\n\n- `curl >= 7.46.0, < 8.21.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `curl 8.21.0`\n\n## Vendor advisories\n\n- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)\n- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)\n- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8924.json)\n- **RHSA-2026:69125** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69125)","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":203494,"id":"CVE-2026-8924","ts":1789457645785,"field":"exploit_available","old":"false","new":"true"},{"seq":203493,"id":"CVE-2026-8924","ts":1789457645785,"field":"cvss","old":"6.5","new":"9.1"},{"seq":203492,"id":"CVE-2026-8924","ts":1789457645785,"field":"severity","old":"medium","new":"critical"},{"seq":5542,"id":"CVE-2026-8924","ts":1788887298419,"field":"cvss","old":null,"new":"6.5"},{"seq":5541,"id":"CVE-2026-8924","ts":1788887298419,"field":"severity","old":"none","new":"medium"},{"seq":4417,"id":"CVE-2026-8924","ts":1788886404898,"field":"cvss","old":"6.5","new":null},{"seq":4416,"id":"CVE-2026-8924","ts":1788886404898,"field":"severity","old":"medium","new":"none"},{"seq":3263,"id":"CVE-2026-8924","ts":1788883138518,"field":"cvss","old":null,"new":"6.5"},{"seq":3262,"id":"CVE-2026-8924","ts":1788883138518,"field":"severity","old":"none","new":"medium"}]}