CVE-2026-8924: trailing dot domain super cookie
Modified
AliasesALPINE-CVE-2026-8924UBUNTU-CVE-2026-8924DEBIAN-CVE-2026-8924CGA-32p7-w3f9-gj2wopenSUSE-SU-2026:11266-1CGA-2jxh-p2jh-vcw4CGA-3cv7-hr7g-mvqjCGA-4xgh-3rj8-928xCGA-63h5-jq4m-45j7CGA-78r9-vpwf-76j5CGA-9cgr-5p22-vr46CGA-c9qg-fpgq-j74jCGA-cggx-mm89-hcf4CGA-cp9v-cc78-g6j6CGA-gjc9-p3hr-pq69CGA-grwq-87x4-mwj5CGA-gwgp-f72p-8hp9CGA-hrmc-qqrm-xxpxCGA-j892-9r77-vxmqCGA-mc39-43cc-6hxwCGA-phgr-fgjj-3v35CGA-r96j-7cwr-4vcxCGA-rjrv-xc2r-24ghCGA-x8xp-hww8-pmrmCGA-xr7f-wxp3-9j78
Published 03-07-2026Last modified 15-09-2026
Vulnerability summary
CVE-2026-8924 is a critical (CVSS 9.1) vulnerability in curl. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
9.1/10
010
Critical · v3.1 (CVE.org)EPSS score
0.66%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 15 · Related 12OPENSUSE-SU-2026:11230-1OPENSUSE-SU-2026:21272-1RHSA-2026:29017RHSA-2026:34975RHSA-2026:69125RHSA-2026:72506RHSA-2026:80511SUSE-SU-2026:22553-1SUSE-SU-2026:22582-1SUSE-SU-2026:22709-1SUSE-SU-2026:22889-1SUSE-SU-2026:2925-1SUSE-SU-2026:2926-1SUSE-SU-2026:3043-1SUSE-SU-2026:3814-1CGA-6HQP-6C2M-3MJFUSN-8487-1
Timeline
- 03-07-2026PublishedVulnerability first disclosed.
- 15-09-2026Last modifiedVulnerability information updated.
Description
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
CVSS metrics
7 scores · 7 sources · 1 versionCritical 9.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS trend
Probability
0.66%
Chance of exploitation in the next 30 days
Percentile
52%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.66% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard11 products
- eco-python-curl< 8.21.0-r0
- eco-python-curl-minimal< 8.21.0-r0
- eco-python-curl-minimal-bin< 8.21.0-r0
- eco-python-curl-minimal-dev< 8.21.0-r0
- eco-python-curl-minimal-doc< 8.21.0-r0
Alpine1 product
- curl≥ 7.46.0, < 8.14.1-r3 | ≥ 7.46.0, < 8.14.1-r4 | ≥ 7.46.0, < 8.22.0-r0 | ≥ 7.46.0, < 8.21.0-r0
Curl1 product
- curl≥ 7.46.0, < 8.14.2 | ≥ 8.15.0, < 8.16.1 | ≥ 8.17.0, < 8.20.1 | ≥ e77b5b7453c1e8ccd7ec0816890d98e2f392e465, < 51beed175dbfc37da3113f6acce60c630c070ce8 | 8.20.0 | 8.19.0 | 8.18.0 | 8.17.0 | 8.16.0 | 8.15.0 | 8.14.1 | 8.14.0 | 8.13.0 | 8.12.1 | 8.12.0 | 8.11.1 | 8.11.0 | 8.10.1 | 8.10.0 | 8.9.1 | 8.9.0 | 8.8.0 | 8.7.1 | 8.7.0 | 8.6.0 | 8.5.0 | 8.4.0 | 8.3.0 | 8.2.1 | 8.2.0 | 8.1.2 | 8.1.1 | 8.1.0 | 8.0.1 | 8.0.0 | 7.88.1 | 7.88.0 | 7.87.0 | 7.86.0 | 7.85.0 | 7.84.0 | 7.83.1 | 7.83.0 | 7.82.0 | 7.81.0 | 7.80.0 | 7.79.1 | 7.79.0 | 7.78.0 | 7.77.0 | 7.76.1 | 7.76.0 | 7.75.0 | 7.74.0 | 7.73.0 | 7.72.0 | 7.71.1 | 7.71.0 | 7.70.0 | 7.69.1 | 7.69.0 | 7.68.0 | 7.67.0 | 7.66.0 | 7.65.3 | 7.65.2 | 7.65.1 | 7.65.0 | 7.64.1 | 7.64.0 | 7.63.0 | 7.62.0 | 7.61.1 | 7.61.0 | 7.60.0 | 7.59.0 | 7.58.0 | 7.57.0 | 7.56.1 | 7.56.0 | 7.55.1 | 7.55.0 | 7.54.1 | 7.54.0 | 7.53.1 | 7.53.0 | 7.52.1 | 7.52.0 | 7.51.0 | 7.50.3 | 7.50.2 | 7.50.1 | 7.50.0 | 7.49.1 | 7.49.0 | 7.48.0 | 7.47.1 | 7.47.0 | 7.46.0
Debian1 product
- curlAll versions (No fix recorded) | < 8.14.1-2+deb13u7 | < 8.21.0~rc2-1
Haxx1 product
- curl≥ 7.46.0, < 8.21.0
Opensuse1 product
- libpsl&distro=openSUSE Tumbleweed< 0.23.0-1.1
Ubuntu1 product
- curl< 7.47.0-1ubuntu2.19+esm16 | < 7.58.0-2ubuntu3.24+esm9 | < 7.68.0-1ubuntu2.25+esm4 | < 7.81.0-1ubuntu1.25 | < 8.5.0-2ubuntu10.10 | < 8.14.1-2ubuntu1.4 | < 8.18.0-1ubuntu2.2
Wolfi1 product
- libcurl4All versions (No fix recorded)
8 vendors · 18 products
