CVE-2026-8924
ADVISORY - debianSummary
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.
- curl 8.21.0~rc2-1 [trixie] - curl (Minor issue) [bookworm] - curl (Minor issue; trailing-dot super cookie; PSL-enabled build mitigates) [bullseye] - curl (Minor issue; trailing-dot super cookie; PSL-enabled build mitigates) https://curl.se/docs/CVE-2026-8924.html Introduced with: https://github.com/curl/curl/commit/e77b5b7453c1e8ccd7ec0816890d98e2f392e465 (curl-7_46_0) Fixed by: https://github.com/curl/curl/commit/51beed175dbfc37da3113f6acce60c630c070ce8 (rc-8_21_0-1, curl-8_21_0)
EPSS Score: 0.0056 (0.439)
Common Weakness Enumeration (CWE)
Alpine
CREATED
UPDATED
ADVISORY IDCVE-2026-8924
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
| Package | Type | OS Name | OS Version | Affected Ranges | Fix Versions |
|---|---|---|---|---|---|
| alpine/curl | apk | alpine | 3.23 | <=8.19.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.50.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.50.2-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.50.3-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.51.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.52.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.53.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.53.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.54.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.55.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.56.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.57.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.59.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.60.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.61.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.61.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.62.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.64.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.65.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.66.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.12.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.21 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.50.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.50.2-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.50.3-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.51.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.52.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.53.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.53.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.54.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.55.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.56.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.57.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.59.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.60.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.61.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.61.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.62.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.64.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.65.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.66.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.14.1-r3 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.22 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <=8.17.0-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.23 | <=8.20.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.24 | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.20 | <=7.50.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.50.2-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.50.3-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.51.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.52.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.53.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.53.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.54.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.55.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.56.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.57.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.59.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.60.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.61.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.61.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.62.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.64.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.65.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.66.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.0-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.20 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | edge | <8.21.0-r0 | 8.21.0-r0 |
| alpine/curl | apk | alpine | 3.19 | <=7.50.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.50.2-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.50.3-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.51.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.52.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.53.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.53.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.54.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.55.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.56.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.57.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.59.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.60.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.61.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.61.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.62.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.64.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.65.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.66.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.71.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.72.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.74.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.76.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.77.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.78.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.79.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.83.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.83.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.84.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.85.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.86.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.87.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=7.88.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.0.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.1.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.10.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.11.1-r1 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.12.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.14.1-r2 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.3.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.4.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.5.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.6.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.7.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.0-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r0 | Not yet available |
| alpine/curl | apk | alpine | 3.19 | <=8.9.1-r1 | Not yet available |
Severity and metrics
No CVSS data available from this advisory.
Debian
CREATED
UPDATED
ADVISORY IDCVE-2026-8924
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Ubuntu
CREATED
UPDATED
ADVISORY IDCVE-2026-8924
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
N/AlowChainguard
CREATED
UPDATED
ADVISORY ID
CGA-6hqp-6c2m-3mjf
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
Photon
CREATED
UPDATED
ADVISORY ID
CVE-2026-8924
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
CVSS SCORE
9.1criticalminimos
CREATED
UPDATED
ADVISORY ID
MINI-8c6p-f92m-vjf2
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-
minimos
CREATED
UPDATED
ADVISORY ID
MINI-x5mc-fjc6-6vcv
EXPLOITABILITY SCORE
-
EXPLOITS FOUND
-
COMMON WEAKNESS ENUMERATION (CWE)-