# CVE-2026-8924: curl cookie parsing bypass via trailing dot hostname

Source: https://junglewise.ai/threats/cve-2026-8924-curl-cookie-parsing-bypass-via-trailing-dot-hostname  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-8924 · Severity: info · CVSS 0 · Published 2026-07-03

A flaw in the curl data transfer tool allows malicious websites to set 'super cookies' that bypass standard security checks. This could allow an attacker to inject cookies that are then sent to unrelated third-party websites, potentially leading to unauthorized data exposure or session manipulation. The issue specifically occurs when hostnames are used with a trailing dot.

## Quick answers

**Is CVE-2026-8924 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8924 being exploited in the wild.

**How severe is CVE-2026-8924?** Informational severity, with a CVSS score of 0, published 3 July 2026.

**Which products and versions are affected?** curl curl 7.46.0 to 8.20.0; curl libcurl 7.46.0 to 8.20.0.

**Is there a fix for CVE-2026-8924?** A patch was published on 2026-06-24: curl 8.21.0 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8924 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8924?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in curl's cookie handling (CWE-201) arises when a trailing dot is used in a hostname (e.g., 'example.co.uk.'). The parsing logic fails to correctly apply Public Suffix List (PSL) restrictions in this specific scenario, allowing a malicious origin to set cookies for a broader domain scope than permitted. An attacker-controlled server can thus inject cookies that curl will subsequently transmit to unrelated third-party domains. This issue affects curl and libcurl versions 7.46.0 through 8.20.0 and is fixed in version 8.21.0.

## Affected products

- curl curl 7.46.0 to 8.20.0
- curl libcurl 7.46.0 to 8.20.0

## Timeline

- 2026-05-13: disclosed: Reported to curl project via HackerOne
- 2026-06-17: other: Distributions notified via distros@openwall
- 2026-06-24: patched: curl 8.21.0 released with fix
- 2026-06-24: advisory: Project curl security advisory published
- 2026-07-03: other: NVD publication date

## References

- [https://curl.se/docs/CVE-2026-8924.html](https://curl.se/docs/CVE-2026-8924.html)
- [https://curl.se/docs/CVE-2026-8924.json](https://curl.se/docs/CVE-2026-8924.json)
- [https://hackerone.com/reports/3733905](https://hackerone.com/reports/3733905)