Skip to main content

Insertion of Sensitive Information Into Sent Data

CVE-2026-8924

High
9.1/10

Summary

A flaw in curls cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl scopes subsequently and transmits to unrelated third-party domains. Affected versions are from curl 7.46.0 through 8.20.0.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-201 - Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References

Advisory Timeline

  • Published