Skip to main content

curl CVE-2026-8924

| EUVDEUVD-2026-41505 CRITICAL
Insertion of Sensitive Information Into Sent Data (CWE-201)
2026-06-24 GHSA-hm6c-rc5h-32m9
Authentication Bypass Curl Haxx
Critical
Disputed · 9.1 Vendor
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Lure curl client to malicious server
  2. Delivery
    Server returns crafted Set-Cookie
  3. Exploit
    Bypass Public Suffix List check
  4. Execution
    curl stores super cookie broadly
  5. Persist
    Cookie sent to unrelated third-party domains
  6. Impact
    Cross-domain cookie injection/session abuse

Vulnerability Assessment

Weakness
CWE
CWE-201
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Outbound data filtering
Exploitation Conditions

Requires the victim's curl/libcurl to have cookie handling enabled (e.g. using -b/-c, --cookie/--cookie-jar, or the libcurl cookie options) and to connect to an origin the attacker controls or can inject responses into; the malicious server must return a Set-Cookie that trips the flawed Public Suffix List check to set a 'super cookie'. Limiting factors: if curl is invoked without any cookie engine active, the code path is not reached; the attacker needs the client to initiate a connection to the malicious/attacker-influenced server (or a MITM position); and impact is confined to cookie scoping/injection across domains rather than direct code execution. The CVSS vector marks it AV:N/AC:L/PR:N/UI:N, so no authentication on the curl side is required once a request to the hostile origin occurs.
Impact

The signals are in tension. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) yields 9.1 and implies trivially remote, unauthenticated, high-confidentiality-and-integrity impact, but the described effect - cookie mis-scoping to third-party domains - is closer to a limited integrity/confidentiality issue than to full compromise, so the C:H/I:H rating appears aggressive relative to the description. Real-world risk is further tempered by low EPSS (0.22%, 12th percentile), absence from CISA KEV (no confirmed active exploitation), and no identified public exploit code. Exploitation also requires the victim to connect to an attacker-controlled or attacker-influenced server and to be using curl's cookie engine, which narrows practical impact. Net assessment: a genuine and broadly-present correctness/security defect worth patching due to curl's ubiquity, but the raw 9.1 overstates the day-to-day exploitation risk - treat as a routine-priority patch rather than an emergency, absent evidence of exploitation.
Exploit ScenarioDerived

An attacker operates or hijacks an HTTP server and lures a curl-based client or automated agent to make a request to it. The server returns a Set-Cookie response crafted to bypass the PSL check, so curl accepts a super cookie scoped to a broad suffix and later attaches it to requests toward unrelated third-party domains, enabling cookie injection or session fixation against those sites. No public exploit code was identified, but the network attack vector and low complexity make weaponization straightforward for anyone able to control a response.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv3 – Jul 06, 2026

Cross-domain cookie injection in curl (versions 7.46.0 through 8.20.0) lets a malicious or compromised HTTP server set 'super cookies' that bypass the Public Suffix List (PSL) safeguard, causing curl to scope attacker-supplied cookies to unrelated third-party domains and transmit them on later requests. Rated CVSS 9.1 and tagged as an authentication bypass, the flaw undermines cookie origin isolation, but EPSS is low at 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis. A patched release is available from the curl project.

Earlier versions of this analysis (2)
v2 Jul 06, 2026 - 18:32 cvss changed CVSS 9.1

Cookie injection in curl (versions through 8.20.0) lets a malicious HTTP server set 'super cookies' that evade the Public Suffix List (PSL) safeguard, so an attacker-controlled origin can plant cookies that curl then scopes and sends to unrelated third-party domains. This is a cross-domain cookie-scoping/authentication-bypass class issue that can enable session fixation or cookie leakage rather than direct code execution. No public exploit identified at time of analysis; EPSS is low (0.22%, 12th percentile) and the flaw is not on CISA KEV.

v1 Jun 24, 2026 - 18:25

Trailing dot domain handling in curl's cookie engine allows cookies scoped to a trailing-dot domain (e.g., '.example.com.') to be treated as super cookies applicable beyond their intended domain boundary. Applications and scripts using libcurl that process HTTP responses from attacker-controlled or compromised servers could have cookies incorrectly transmitted to unintended third-party domains. Rated LOW severity by the curl project; no public exploit identified at time of analysis and no CISA KEV listing.

RemediationAI

Patch available per vendor advisory - upgrade curl/libcurl to the fixed release published by the curl project at https://curl.se/docs/CVE-2026-8924.html; an exact fixed version string was not provided in the input, so confirm the target version directly from that advisory (the affected range extends through 8.20.0, so the fix is a later release). On Linux distributions, apply the packaged update, e.g. via Ubuntu USN-8487-1 (https://ubuntu.com/security/notices/USN-8487-1) and equivalent vendor packages, and rebuild or restart any long-running services that statically or dynamically link libcurl. If immediate patching is not possible, the practical compensating control is to disable curl's cookie engine for untrusted fetches - do not pass -b/--cookie or -c/--cookie-jar and avoid loading a shared cookie file across origins - which prevents the mis-scoping entirely at the cost of losing cookie-based session handling; alternatively, isolate cookie jars per-origin and avoid reusing a single jar across mixed trust domains. Restrict curl usage to trusted endpoints where feasible, since exploitation requires connecting to a malicious server.

Affected VersionsENISA

curl 7.88.0 ≤7.88.0
curl 7.54.0 ≤7.54.0
curl 8.0.1 ≤8.0.1
curl 7.80.0 ≤7.80.0
curl 7.47.1 ≤7.47.1
curl 7.72.0 ≤7.72.0
curl 7.88.1 ≤7.88.1
curl 7.58.0 ≤7.58.0
curl 8.14.0 ≤8.14.0
curl 8.12.1 ≤8.12.1
curl 7.56.0 ≤7.56.0
curl 7.73.0 ≤7.73.0
curl 7.83.1 ≤7.83.1
curl 8.9.0 ≤8.9.0
curl 8.20.0 ≤8.20.0
curl 7.64.0 ≤7.64.0
curl 7.56.1 ≤7.56.1
curl 8.5.0 ≤8.5.0
curl 7.82.0 ≤7.82.0
curl 8.10.1 ≤8.10.1
curl 7.76.1 ≤7.76.1
curl 7.52.1 ≤7.52.1
curl 7.76.0 ≤7.76.0
curl 8.2.0 ≤8.2.0
curl 7.59.0 ≤7.59.0
curl 7.85.0 ≤7.85.0
curl 7.65.2 ≤7.65.2
curl 7.50.2 ≤7.50.2
curl 7.60.0 ≤7.60.0
curl 8.11.0 ≤8.11.0
curl 7.47.0 ≤7.47.0
curl 7.50.0 ≤7.50.0
curl 8.14.1 ≤8.14.1
curl 7.61.1 ≤7.61.1
curl 7.84.0 ≤7.84.0
curl 7.78.0 ≤7.78.0
curl 7.75.0 ≤7.75.0
curl 7.55.1 ≤7.55.1
curl 8.10.0 ≤8.10.0
curl 7.49.0 ≤7.49.0
curl 8.3.0 ≤8.3.0
curl 7.61.0 ≤7.61.0
curl 7.52.0 ≤7.52.0
curl 7.66.0 ≤7.66.0
curl 7.50.1 ≤7.50.1
curl 7.46.0 ≤7.46.0
curl 8.2.1 ≤8.2.1
curl 8.17.0 ≤8.17.0
curl 8.9.1 ≤8.9.1
curl 7.81.0 ≤7.81.0
curl 7.50.3 ≤7.50.3
curl 7.71.0 ≤7.71.0
curl 7.62.0 ≤7.62.0
curl 8.1.0 ≤8.1.0
curl 8.8.0 ≤8.8.0
curl 7.67.0 ≤7.67.0
curl 7.65.1 ≤7.65.1
curl 7.77.0 ≤7.77.0
curl 8.15.0 ≤8.15.0
curl 8.12.0 ≤8.12.0
curl 8.19.0 ≤8.19.0
curl 8.7.0 ≤8.7.0
curl 7.74.0 ≤7.74.0
curl 7.64.1 ≤7.64.1
curl 8.13.0 ≤8.13.0
curl 7.63.0 ≤7.63.0
curl 7.68.0 ≤7.68.0
curl 7.79.1 ≤7.79.1
curl 8.18.0 ≤8.18.0
curl 8.1.1 ≤8.1.1
curl 7.69.0 ≤7.69.0
curl 7.83.0 ≤7.83.0
curl 8.7.1 ≤8.7.1
curl 8.4.0 ≤8.4.0
curl 7.79.0 ≤7.79.0
curl 7.69.1 ≤7.69.1
curl 7.86.0 ≤7.86.0
curl 8.11.1 ≤8.11.1
curl 7.87.0 ≤7.87.0
curl 7.55.0 ≤7.55.0
curl 8.6.0 ≤8.6.0
curl 7.57.0 ≤7.57.0
curl 7.48.0 ≤7.48.0
curl 7.51.0 ≤7.51.0
curl 7.70.0 ≤7.70.0
curl 8.16.0 ≤8.16.0
curl 7.49.1 ≤7.49.1
curl 7.71.1 ≤7.71.1
curl 7.65.3 ≤7.65.3
curl 7.53.0 ≤7.53.0
curl 7.54.1 ≤7.54.1
curl 8.0.0 ≤8.0.0
curl 8.1.2 ≤8.1.2
curl 7.53.1 ≤7.53.1
curl 7.65.0 ≤7.65.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

curl's cookie engine enforces the Public Suffix List to prevent a server from setting a cookie for a broad domain suffix (e.g. '.co.uk' or '.com') that would then be shared across every site under it - the classic 'super cookie' problem. The vulnerability is a logic flaw in the domain-matching path of curl's cookie parser that fails to reject certain domain values against the PSL, so cookies that should be discarded are instead accepted and scoped to a wider domain than the origin is entitled to. Because CWE is listed as N/A, the most fitting root-cause class is improper cross-domain/origin restriction of cookie handling (CWE-923-style improper restriction of communications channel, related to CWE-565 reliance on untrusted cookie data). Per the EUVD CPE/version data the defect is present across the libcurl/curl cookie code from 7.46.0 up to and including 8.20.0, affecting both the curl CLI and any application linking libcurl with cookie handling enabled.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (CNA) PRIMARY 9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI 7.2 HIGH

Malicious server needs no auth (PR:N, AC:L); cookies cross into other origins so S:C; impact is limited cookie mis-scoping, not full compromise, hence C:L/I:L and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE 8.1 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Red Hat 6.5 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

1
CVSS changed
Jul 06, 2026 - 18:22 NVD
9.1 (CRITICAL)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

CVE-2026-8924 in curl enables cross-domain cookie injection that bypasses authentication controls on systems running versions 7.46.0 through 8.20.0. While a patch is available and current exploitation likelihood is low (0.2% EPSS), the vulnerability's critical CVSS rating and curl's widespread use in web services and automation creates material authentication risk across the organization if left unpatched.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
Ubiquitous
curl/libcurl ships in nearly every OS, container, and application stack
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-201 – Insertion of Sensitive Information Into Sent Data

View all
CVE-2026-39912 CRITICAL POC
9.1
CVE-2021-26566 CRITICAL POC
9.0
CVE-2026-27934 HIGH POC
8.7
CVE-2025-60188 HIGH POC
7.5
CVE-2025-58098 HIGH POC
8.3
CVE-2024-43283 MEDIUM POC
5.3
CVE-2026-105849 HIGH POC
7.7
CVE-2020-37150 HIGH POC
7.5

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SLES15-SP5-CHOST-BYOS-SAP-CCloud Affected
SLES15-SP6-CHOST-BYOS Affected
SLES15-SP6-CHOST-BYOS-Aliyun Affected
SLES15-SP6-CHOST-BYOS-Azure Affected
SLES15-SP6-CHOST-BYOS-EC2 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:29017 ADVISORY https://access.redhat.com/errata/RHSA-2026:34975 ADVISORY https://curl.se/docs/CVE-2026-11564.html ADVISORY https://curl.se/docs/CVE-2026-12064.html ADVISORY https://curl.se/docs/CVE-2026-9080.html ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8924 ADVISORY https://seclists.org/oss-sec/2026/q2/1012 ADVISORY https://ubuntu.com/security/notices/USN-8487-1 ADVISORY https://vuldb.com/vuln/376064 REF https://curl.se/docs/CVE-2026-8924.html REF https://curl.se/docs/CVE-2026-8924.json REF https://hackerone.com/reports/3733905

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy