---
id: CVE-2026-8924
title: |-
  A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
  "super cookies" that bypass the Public Suffix List check
summary: |-
  A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
  "super cookies" that bypass the Public Suffix List check. This enables an
  attacker-controlled origin to inject cookies that curl subsequently scopes and
  transmit…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-201
  - CWE-565
vendor: haxx
product: curl
affected:
  - 'curl >= 7.46.0, < 8.21.0'
patched:
  - curl 8.21.0
published: '2026-07-03'
updated: '2026-09-15'
sourceUpdated: '2026-09-15T07:16:32.573'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8924'
references:
  - url: 'https://curl.se/docs/CVE-2026-8924.html'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://curl.se/docs/CVE-2026-8924.json'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3733905'
    label: 2499f714-1537-4658-8207-48ae4bb9eae9
  - url: 'https://hackerone.com/reports/3733905'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8924.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-8924'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2496765'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-8924'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8924'
  - url: 'https://access.redhat.com/errata/RHSA-2026:29017'
  - url: 'https://access.redhat.com/errata/RHSA-2026:34975'
  - url: 'https://access.redhat.com/errata/RHSA-2026:56869'
  - url: 'https://access.redhat.com/errata/RHSA-2026:69125'
tags:
  - nvd
  - cve.org
  - exploit-available
  - csaf
  - vex
  - red-hat
  - score-dispute
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-06T16:56:31.860200Z'
epss: 0.00661
epssPercentile: 0.49412
scores:
  nvd: 9.1
  vendor: 6.5
ingestedAt: '2026-07-04T04:55:39.436Z'
---

## Overview

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
"super cookies" that bypass the Public Suffix List check. This enables an
attacker-controlled origin to inject cookies that curl subsequently scopes and
transmits to unrelated third-party domains.

## Affected

- `curl >= 7.46.0, < 8.21.0`

## Remediation

Upgrade past the affected range:

- `curl 8.21.0`

## Vendor advisories

- **RHSA-2026:29017** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:29017)
- **RHSA-2026:34975** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:34975)
- **RHSA-2026:56869** · Red Hat · fixed in: Red Hat JBoss Core Services 2.4.62.SP5 · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:56869)
- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, … · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8924.json)
- **RHSA-2026:69125** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69125)