Cyber Resilience

CVE-2026-8924

Haxx Curl 7.46.0 – 8.21.0

Public PoC
Published
03 July 2026
Modified
07 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 9.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0056 43th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-8924 is a critical-severity an unspecified weakness vulnerability in Haxx Curl. Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Cookies (T1606.001); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party…

more

domains.

CWE(s)
NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1606.001 Web Cookies Credential Access
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.
attack.mitre.org →
Why these techniques?

Directly enables forging/injecting web cookies by bypassing PSL checks, allowing improper scoping and transmission to third-party domains.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1557 Adversary-in-the-Middle Credential Accessconfidence: HIGH
The cookie injection bypass enables an adversary-in-the-middle or malicious server to force curl to send attacker-controlled cookies to third-party domains, directly facilitating session or credential theft via MITM.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Accessconfidence: HIGH
By injecting cookies scoped to unrelated domains, the flaw allows an attacker to steal web session cookies that curl would otherwise only send to the legitimate origin.
attack.mitre.org →
inferred from description · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-8932Same product: Haxx Curl
CVE-2025-5399Same product: Haxx Curl
CVE-2026-6429Same product: Haxx Curl
CVE-2025-10966Same product: Haxx Curl
CVE-2026-7009Same product: Haxx Curl
CVE-2025-14017Same product: Haxx Curl
CVE-2025-13034Same product: Haxx Curl
CVE-2024-9681Same product: Haxx Curl
CVE-2026-5545Same product: Haxx Curl
CVE-2026-8286Same product: Haxx Curl

Affected Assets

haxx
curl
7.46.0 — 8.21.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-4 Information Flow Enforcement
  • SC-7 Boundary Protection
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates the flawed cookie parsing logic by requiring validation of all HTTP cookie inputs against the Public Suffix List before acceptance.

AC-4 Information Flow Enforcement good match
prevent

Enforces correct information flow rules so that cookies scoped by a malicious origin cannot be transmitted to unrelated third-party domains.

SC-7 Boundary Protection partial match
prevent

Boundary protection mechanisms can block or filter cross-domain cookie transmissions that result from the bypassed suffix-list check.

References