PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8924 curl CVE debrief

A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. The vulnerability has significant operational impact, particularly for users of curl who transfer data with URLs, as it could allow attackers to hijack sessions or access sensitive information.

Vendor
curl
Product
Unknown
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-03
Original CVE updated
2026-09-15
Advisory published
2026-07-03
Advisory updated
2026-09-15

Who should care

Users of curl, particularly those who use it to transfer data with URLs, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying patches, updating to the latest version of curl, and monitoring for suspicious activity. Operators, platform administrators, and security teams should assess their exposure and implement necessary controls.

Technical summary

The vulnerability is caused by a flaw in curl's cookie parsing logic, which allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. The vulnerability has a CVSS score of 9.1 and is considered critical. Affected users should apply patches or updates provided by the vendor and consider compensating controls.

Defensive priority

High

Recommended defensive actions

  • Apply the patch provided by the vendor
  • Update curl to the latest version
  • Use a compensating control, such as a web application firewall
  • Monitor for suspicious activity
  • Review relevant logs for exposed assets
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability was reported by an unknown researcher and is described in the NVD database. The vendor has provided a patch and updated the curl documentation to reflect the changes. Evidence is limited, and defenders should verify affected deployments, review official advisories, and monitor for suspicious activity related to curl's cookie parsing logic.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8924 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8924

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8924 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8924

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://curl.se/docs/CVE-2026-8924.html

    2499f714-1537-4658-8207-48ae4bb9eae9 - Patch, Vendor Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://curl.se/docs/CVE-2026-8924.json

    2499f714-1537-4658-8207-48ae4bb9eae9 - Vendor Advisory

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://hackerone.com/reports/3733905

    2499f714-1537-4658-8207-48ae4bb9eae9 - Exploit, Issue Tracking, Third Party Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.