TI-2026-07844 Aliases CVE-2026-8924 GHSA-hm6c-rc5h-32m9

trailing dot domain super cookie

HIGH 80CWE-201Published 2026-07-03 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Partial Red Hat: 18 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-201.

Summary

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set "super cookies" that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00661 51st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial curl (curl): 8.14.2, 8.16.1, 8.20.1Red Hat: 14 advisoriesRed Hat: 18 fixed, 7 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
curl	curl	7.46.0 to before 8.14.2; 8.15.0 to before 8.16.1; 8.17.0 to before 8.20.1	8.14.2, 8.16.1, 8.20.1	Patch available	CNA
curl	curl	8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0; 8.3.0; 8.2.1; 8.2.0; 8.1.2; 8.1.1; 8.1.0; 8.0.1; 8.0.0; 7.88.1; 7.88.0; 7.87.0; 7.86.0; 7.85.0; 7.84.0; 7.83.1; 7.83.0; 7.82.0; 7.81.0; 7.80.0; 7.79.1; 7.79.0; 7.78.0; 7.77.0; 7.76.1; 7.76.0; 7.75.0; 7.74.0; 7.73.0; 7.72.0; 7.71.1; 7.71.0; 7.70.0; 7.69.1; 7.69.0; 7.68.0; 7.67.0; 7.66.0; 7.65.3; 7.65.2; 7.65.1; 7.65.0; 7.64.1; 7.64.0; 7.63.0; 7.62.0; 7.61.1; 7.61.0; 7.60.0; 7.59.0; 7.58.0; 7.57.0; 7.56.1; 7.56.0; 7.55.1; 7.55.0; 7.54.1; 7.54.0; 7.53.1; 7.53.0; 7.52.1; 7.52.0; 7.51.0; 7.50.3; 7.50.2; 7.50.1; 7.50.0; 7.49.1; 7.49.0; 7.48.0; 7.47.1; 7.47.0; 7.46.0	—	No fix listed	CNA

curl Vendorcurl Affected 7.46.0 to before 8.14.2; 8.15.0 to before 8.16.1; 8.17.0 to before 8.20.1 Fixed in 8.14.2, 8.16.1, 8.20.1 Patch available CNA
curl Vendorcurl Affected 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0; 8.5.0; 8.4.0; 8.3.0; 8.2.1; 8.2.0; 8.1.2; 8.1.1; 8.1.0; 8.0.1; 8.0.0; 7.88.1; 7.88.0; 7.87.0; 7.86.0; 7.85.0; 7.84.0; 7.83.1; 7.83.0; 7.82.0; 7.81.0; 7.80.0; 7.79.1; 7.79.0; 7.78.0; 7.77.0; 7.76.1; 7.76.0; 7.75.0; 7.74.0; 7.73.0; 7.72.0; 7.71.1; 7.71.0; 7.70.0; 7.69.1; 7.69.0; 7.68.0; 7.67.0; 7.66.0; 7.65.3; 7.65.2; 7.65.1; 7.65.0; 7.64.1; 7.64.0; 7.63.0; 7.62.0; 7.61.1; 7.61.0; 7.60.0; 7.59.0; 7.58.0; 7.57.0; 7.56.1; 7.56.0; 7.55.1; 7.55.0; 7.54.1; 7.54.0; 7.53.1; 7.53.0; 7.52.1; 7.52.0; 7.51.0; 7.50.3; 7.50.2; 7.50.1; 7.50.0; 7.49.1; 7.49.0; 7.48.0; 7.47.1; 7.47.0; 7.46.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:haxx:curl::::::::	7.46.0 to before 8.21.0	Vulnerable	Haxx

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* Versions 7.46.0 to before 8.21.0 Vulnerable ·Haxx

Remediation

Fix · CNA curl (curl) Fixed in 8.14.2, 8.16.1, 8.20.1

Red Hat 14 advisories

RHSA-2026:93454 Released 2026-11-02 · Red Hat rating Important
curl security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) libcurl-devel-7.76.1-31.el9_6.4
- Red Hat Enterprise Linux BaseOS EUS (v.9.6) curl-7.76.1-31.el9_6.4, curl-minimal-7.76.1-31.el9_6.4, libcurl-7.76.1-31.el9_6.4 +1
RHSA-2026:92859 Released 2026-10-29 · Red Hat rating Important
Satellite 6.17 security update
- Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
RHSA-2026:92858 Released 2026-10-29 · Red Hat rating Important
Satellite 6.16 EUS security update
- Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.31.1-1.el8sat, openvox-server-8.17.0-1.el8sat, yggdrasil-worker-forwarder-0.1.1-1.el8sat
- Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat

Show 11 more Red Hat advisories

RHSA-2026:92860 Released 2026-10-29 · Red Hat rating Important
Satellite 6.18 security update
- Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.31.1-1.el9sat, openvox-server-8.17.0-1.el9sat, yggdrasil-worker-forwarder-0.1.1-1.el9sat
RHSA-2026:92368 Released 2026-10-29 · Red Hat rating Important
curl security, bug fix, and enhancement update
- Red Hat Enterprise Linux BaseOS (v. 8) curl-7.61.1-34.el8_10.18, libcurl-7.61.1-34.el8_10.18, libcurl-devel-7.61.1-34.el8_10.18 +1
RHSA-2026:89197 Released 2026-10-27 · Red Hat rating Critical
OpenShift Container Platform 4.22.20 bug fix and security update
- Red Hat OpenShift Container Platform 4.22 rhcos-aarch64-4.22.9.8.202610241758-0, rhcos-ppc64le-4.22.9.8.202610241758-0, rhcos-s390x-4.22.9.8.202610241758-0 +1
RHSA-2026:82939 Released 2026-10-14 · Red Hat rating Important
Red Hat Update Infrastructure 5.3 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
RHSA-2026:80511 Released 2026-10-12 · Red Hat rating Moderate
curl security update
- Red Hat Enterprise Linux AppStream (v. 9) libcurl-devel-7.76.1-40.el9_8.8
- Red Hat Enterprise Linux BaseOS (v. 9) curl-7.76.1-40.el9_8.8, curl-minimal-7.76.1-40.el9_8.8, libcurl-7.76.1-40.el9_8.8 +1
RHSA-2026:79357 Released 2026-10-08 · Red Hat rating Important
Red Hat Cost Management On-Premise container image update
- Red Hat Cost Management On-Premise 1 registry.redhat.io/costmanagement/costmanagement-ui-rhel10
RHSA-2026:72506 Released 2026-09-28 · Red Hat rating Important
curl security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) libcurl-devel-8.12.1-1.el10_0.10
- Red Hat Enterprise Linux BaseOS EUS (v. 10.0) curl-8.12.1-1.el10_0.10, libcurl-8.12.1-1.el10_0.10, libcurl-minimal-8.12.1-1.el10_0.10
RHSA-2026:69125 Released 2026-09-21 · Red Hat rating Important
curl security update
- Red Hat Enterprise Linux AppStream (v. 10) libcurl-devel-8.12.1-4.el10_2.6
- Red Hat Enterprise Linux BaseOS (v. 10) curl-8.12.1-4.el10_2.6, libcurl-8.12.1-4.el10_2.6, libcurl-minimal-8.12.1-4.el10_2.6
RHSA-2026:56869 Released 2026-08-19 · Red Hat rating Important
Red Hat JBoss Core Services Apache HTTP Server 2.4.62 SP5 security update
- Red Hat JBoss Core Services 2.4.62.SP5
RHSA-2026:34975 Released 2026-07-02 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images cargo-1.96.1-1.hum1@aarch64, cargo-1.96.1-1.hum1@x86_64, clippy-1.96.1-1.hum1@aarch64 +36
RHSA-2026:29017 Released 2026-06-24 · Red Hat rating Important
Red Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images curl-8.21.0-0.1.hum1@aarch64, curl-8.21.0-0.1.hum1@src, curl-8.21.0-0.1.hum1@x86_64 +6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-07-03
curl 8.14.2, 8.16.1, 8.20.1
13 records Highest priority Priority HIGH 12 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-10231 cross-origin Digest auth state leakPriority HIGH 82
- TI-2026-09063 HTTP/2 stream-dependency tree UAFPriority HIGH 82
- TI-2026-07976 stale proxy password leakPriority HIGH 82
Show all 13 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux 7	Affected	No fix yet
Red Hat JBoss Core Services	Affected	No fix yet
Red Hat OpenShift Container Platform 4	Affected	No fix yet
Red Hat OpenShift Container Platform 5	Affected	No fix yet
Red Hat OpenShift Dev Spaces	Affected	No fix yet
Red Hat Satellite 6	Affected	No fix yet
Red Hat Cost Management On-Premise 1	Fixed	RHSA-2026:79357
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:69125
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:80511
Red Hat Enterprise Linux AppStream EUS (v. 10.0)	Fixed	RHSA-2026:72506
Red Hat Enterprise Linux AppStream EUS (v.9.6)	Fixed	RHSA-2026:93454
Red Hat Enterprise Linux BaseOS (v. 10)	Fixed	RHSA-2026:69125
Red Hat Enterprise Linux BaseOS (v. 8)	Fixed	RHSA-2026:92368
Red Hat Enterprise Linux BaseOS (v. 9)	Fixed	RHSA-2026:80511
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)	Fixed	RHSA-2026:72506
Red Hat Enterprise Linux BaseOS EUS (v.9.6)	Fixed	RHSA-2026:93454
Red Hat Hardened Images	Fixed	RHSA-2026:29017, RHSA-2026:34975
Red Hat JBoss Core Services 2.4.62.SP5	Fixed	RHSA-2026:56869
Red Hat OpenShift Container Platform 4.22	Fixed	RHSA-2026:89197
Red Hat Satellite 6.16 for RHEL 8	Fixed	RHSA-2026:92858
Red Hat Satellite 6.16 for RHEL 9	Fixed	RHSA-2026:92858
Red Hat Satellite 6.17 for RHEL 9	Fixed	RHSA-2026:92859
Red Hat Satellite 6.18 for RHEL 9	Fixed	RHSA-2026:92860
Red Hat Update Infrastructure 5	Fixed	RHSA-2026:82939

Not affected: 10 products

Confidential Compute Attestation
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat OpenShift AI (RHOAI)
Red Hat Satellite 6
Red Hat Satellite 6.16 for RHEL 8
Red Hat Satellite 6.16 for RHEL 9
Red Hat Satellite 6.17 for RHEL 9
Red Hat Satellite 6.18 for RHEL 9
Red Hat Trusted Profile Analyzer

Timeline

2026-10-02 Threatist record created from CVE-2026-8924
2026-10-03 Alias added: GHSA-hm6c-rc5h-32m9
2026-10-07 EPSS moved to the 50th–90th percentile
2026-10-09 Fix available: RHSA-2026:56869 · Red Hat
2026-10-09 Fix available: RHSA-2026:79357 · Red Hat
2026-10-09 Fix available: Red Hat Cost Management On-Premise 1, Red Hat JBoss Core Services 2.4.62.SP5 · Red Hat
2026-10-12 Fix available: RHSA-2026:80511 · Red Hat
2026-10-12 Fix available: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat
2026-10-16 Fix available: RHSA-2026:82939 · Red Hat
2026-10-16 Fix available: Red Hat Update Infrastructure 5 · Red Hat
2026-10-23 Affected versions changed · Red Hat
2026-10-29 Fix available: RHSA-2026:89197 · Red Hat
2026-10-29 Fix available: Red Hat OpenShift Container Platform 4.22 · Red Hat
2026-10-29 Fix available: RHSA-2026:92368 · Red Hat
2026-10-29 Fix available: Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat
2026-10-30 Fix available: RHSA-2026:92858 · Red Hat
2026-10-30 Fix available: RHSA-2026:92859 · Red Hat
2026-10-30 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 · Red Hat
2026-10-30 Fix available: RHSA-2026:92860 · Red Hat
2026-10-30 Fix available: Red Hat Satellite 6.18 for RHEL 9 · Red Hat
2026-11-02 Fix available: RHSA-2026:93454 · Red Hat
2026-11-02 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6) · Red Hat
2026-11-06 Affected versions changed · Red Hat

References

TI-2023-19922 Out-of-bounds write in curl CVSS 3.1CRITICAL 9.8
TI-2026-16162 Negotiate ambient user conn reuse CVSS 3.1CRITICAL 9.8
TI-2026-10231 cross-origin Digest auth state leak CVSS 3.1CRITICAL 9.8
TI-2026-09063 HTTP/2 stream-dependency tree UAF CVSS 3.1CRITICAL 9.8
TI-2026-07976 stale proxy password leak CVSS 3.1CRITICAL 9.8
TI-2026-07845 SASL double-free CVSS 3.1CRITICAL 9.8

See all 103 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences