Curl Cookie Parsing Vulnerability: Super Cookies Bypass PSL
CVE-2026-8924 Published on July 3, 2026

trailing dot domain super cookie
A flaw in curls cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

NVD

Vulnerability Analysis

CVE-2026-8924 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. An automatable proof of concept (POC) exploit exists. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. Sensitive information could include data that is sensitive in and of itself (such as credentials or private messages), or otherwise useful in the further exploitation of the system (such as internal file system structure).


Products Associated with CVE-2026-8924

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-8924 are published in these products:

Canonical Ubuntu Linux
 
Haxx Curl
 
Red Hat Http Server
 

Affected Versions

curl: curl: curl: