CVE Watch7 jul 2026

CVE-2026-8924

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This e

CVSS

9.1

Crítico

EPSS

0.6%

p47

KEV

—

Exploit Today

0-100

Publicado: 3 jul 2026 · Última mod.: 7 jul 2026

EPSS · 30d

0.2%EPSS · 30 días0.6%

2026-07-042026-07-17

Descripción técnica

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Referencias oficiales

curl.sehttps://curl.se/docs/CVE-2026-8924.html
curl.sehttps://curl.se/docs/CVE-2026-8924.json
hackerone.comhttps://hackerone.com/reports/3733905
hackerone.comhttps://hackerone.com/reports/3733905

CVEs relacionados

Sin CVEs relacionados por CWE o producto.