CVE-2026-8924: curl Cookie Domain Matching Bypass via Trailing Dot

CVE-2026-8924: Trailing Dot Supercookie for Public Suffix Domains Vulnerability Overview A PSL-enabled curl build rejects a public suffix cookie, such as , but accepts the trailing dot variant . When the request host also uses a trailing dot, in a replay scenario, a response from sets , and curl subsequently sends to within the same cookie redirection flow. In the canonical control case, with is correctly rejected as expected. This indicates an inconsistency in public suffix handling between canonical hostnames and trailing-dot FQDN forms. Scope of Impact Affected Versions: curl 8.20.0 (Debian Testing) and 8.21.0-DEV Reproduction Environment: curl 8.20.0 (x86_64-pc-linux-gnu) libcurl/8.20.0 OpenSSL/3.6.2 zlib/1.3.2 brotli/1.0.9 zstd/1.5.7 libidn2/2.3.3 libpsl/0.21.5 libssh2/1.11.1 nghttp2/1.60.0 nghttp3/1.22.1 nghttp2/1.15.0 mitkrb5/1.22.1 OpenLDAP/2.6.13 Release Date: 2026-04-29 Security Patched Version: 8.20.0.1 Supported Protocols: dict file ftp ftps gopher gophers http https imap imaps ipfs ipns ldap ldaps mqtt mttts pop3s pop3s rtsp scp sftp smtp smtps telnet tftp ws wss Features: alt-svc AsyncDNS brotli GSS-API HSTS HTTP2 HTTP3 HTTP-PROXY IDN IPv6 Kerberos Largefile LDAP SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd Remediation Fix Status: Resolved Disclosure Date: June 24, 2026, 8:28 AM UTC Weakness Type: Use of Incorrectly Resolved Name or Reference CVE ID: CVE-2026-8924 Reporter: vegapent Participants: curl Report ID: #173906 Severity: Low (0.1 - 3.9) Total Reward: None Account Details: None Reproduction Steps Use the attached PoC script:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-8924: curl Cookie Domain Matching Bypass via Trailing Dot