CVE-2026-8924: trailing dot domain super cookie
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 8.21.0-2 - Compensating control
Mitigate by preventing untrusted/malicious HTTP servers from setting cookies when using curl (e.g., restrict outbound access/egress to trusted origins via firewall or allowlist).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8924?
The severity of CVE-2026-8924 is rated as risk 21.
How do I fix CVE-2026-8924?
To fix CVE-2026-8924, update your version of curl to the latest release that addresses this vulnerability.
What type of attack does CVE-2026-8924 enable?
CVE-2026-8924 enables an attacker to inject cookies that can be scoped and transmitted to unrelated third-party domains.
Which software is affected by CVE-2026-8924?
CVE-2026-8924 affects the curl software, particularly in its cookie parsing logic.
When was CVE-2026-8924 published?
CVE-2026-8924 was published on July 3, 2026.