Bug 2496765 (CVE-2026-8924)

Summary: CVE-2026-8924 curl: curl: Cookie injection via malicious HTTP server using super cookies
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anthomas, aos-team-art-private, asdas, bbrownin, crizzo, dbosanac, dpaolell, ehelms, ggainey, gtanzill, jbuscemi, jdelft, jpasqual, jreimann, jupierce, juwatts, kshier, lgarciaa, mbiarnes, mdellweg, mdessi, mhulan, mrizzi, nmoumoul, osousa, pcattana, pcreech, ppalepu, ppostler, prdhamdh, rchan, rekumar, rhel-process-autobot, sdawley, sghai, sidsharm, smallamp, stcannon, suppawar, teagle, tmalecek, vlaad, vvoronko, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2497598, 2497599, 2497597    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-03 07:01:55 UTC
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set
'super cookies' that bypass the Public Suffix List check. This enables an
attacker-controlled origin to inject cookies that curl subsequently scopes and
transmits to unrelated third-party domains.