CVE-2026-8924
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
Risk Assessment
The risk is that an attacker can break domain isolation, potentially hijacking user sessions or credentials on other sites.
Recommendation
It is recommended to immediately update curl to a version that includes a fix for this vulnerability.
Original NVD description (English source)
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.