A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that…
Critical CVSS 9.1
Summary
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
Sources
- NVD DATABASE
Original Links
- https://curl.se/docs/CVE-2026-8924.html Patch
- https://curl.se/docs/CVE-2026-8924.json Vendor Advisory
- https://hackerone.com/reports/3733905 Exploit
- https://hackerone.com/reports/3733905 Exploit
Timeline
- nvd_ingest NVD