CVE-2026-8924

Critical · CVSS 9.1

CVSS: 9.1; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-201, NVD-CWE-noinfo

Description

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

References

https://curl.se/docs/CVE-2026-8924.html
https://curl.se/docs/CVE-2026-8924.json
https://hackerone.com/reports/3733905
https://hackerone.com/reports/3733905

Status: profiled · ingested 2026-09-15T12:00:31.000Z