Sploitus

CVE-2026-8924

No indexed exploits for CVE-2026-8924 yet

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Affected products
Ibm Aix, Linuxmint, Curl
Haxx Curl
< 8.21.0
CVSS 3.1
9.1 CRITICAL
EPSS
0.6% (43th percentile)
NVD status
Analyzed
Published
2026-07-03
CVE-2026-8924 at NVD
Authoritative description, scoring and affected products

No indexed exploits for CVE-2026-8924 yet

Our index is partial: it proves presence, never absence

No exploit for CVE-2026-8924 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.