Skip to main content

curl CVE-2026-8924

| EUVDEUVD-2026-41505 CRITICAL
2026-06-24 GHSA-hm6c-rc5h-32m9
Authentication Bypass Curl
9.1
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.2 HIGH

Malicious server needs no auth (PR:N, AC:L); cookies cross into other origins so S:C; impact is limited cookie mis-scoping, not full compromise, hence C:L/I:L and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from Vendor (CNA).

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Analysis Updated
Jul 06, 2026 - 18:32 vuln.today
v3 (cvss_changed)
Analysis Updated
Jul 06, 2026 - 18:32 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 06, 2026 - 18:22 vuln.today
cvss_changed
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.1 (CRITICAL)
Analysis Generated
Jun 24, 2026 - 18:25 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Cross-domain cookie injection in curl (versions 7.46.0 through 8.20.0) lets a malicious or compromised HTTP server set 'super cookies' that bypass the Public Suffix List (PSL) safeguard, causing curl to scope attacker-supplied cookies to unrelated third-party domains and transmit them on later requests. Rated CVSS 9.1 and tagged as an authentication bypass, the flaw undermines cookie origin isolation, but EPSS is low at 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Lure curl client to malicious server
Delivery
Server returns crafted Set-Cookie
Exploit
Bypass Public Suffix List check
Execution
curl stores super cookie broadly
Persist
Cookie sent to unrelated third-party domains
Impact
Cross-domain cookie injection/session abuse
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the victim's curl/libcurl to have cookie handling enabled (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals are in tension. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker operates or hijacks an HTTP server and lures a curl-based client or automated agent to make a request to it. The server returns a Set-Cookie response crafted to bypass the PSL check, so curl accepts a super cookie scoped to a broad suffix and later attaches it to requests toward unrelated third-party domains, enabling cookie injection or session fixation against those sites. …
Remediation Patch available per vendor advisory - upgrade curl/libcurl to the fixed release published by the curl project at https://curl.se/docs/CVE-2026-8924.html; an exact fixed version string was not provided in the input, so confirm the target version directly from that advisory (the affected range extends through 8.20.0, so the fix is a later release). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify all systems and applications using curl versions 7.46.0 through 8.20.0, prioritizing production web services and APIs. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Curl

View all
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re
CVE-2023-27533 HIGH POC
8.8 Mar 30

A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an atta
CVE-2025-0665 HIGH POC
7.0 Feb 05

A double-close vulnerability exists in libcurl when tearing down connection channels after threaded name resolution, cau
CVE-2022-27778 HIGH POC
8.1 Jun 02

A use of incorrectly resolved name vulnerability fixed in 7.83.1 might remove the wrong file when `--no-clobber` is used
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2020-8177 HIGH POC
7.8 Dec 14

curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead to

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

Share

CVE-2026-8924 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy