Medium [CVE-2026-8924] Cookie injection via malicious HTTP server using super cookies

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Moderate: Red Hat rates this flaw Moderate (CVSS 6.5) compared to CISA's Critical (9.1).

The scoring difference is due to two factors: first, exploitation requires the victim's curl to connect using a trailing-dot hostname (e.g.,.), a format that is uncommon in practice and incompatible with TLS SNI; second, the direct impact is cookie injection into outbound requests — not exfiltration of victim data to the attacker.

The curl project itself rates this flaw Low severity. Red Hat products that use curl for HTTP communication are affected, but the trailing-dot precondition significantly limits real-world exploitability.

This flaw has not been shown to enable impacts beyond session integrity modification. Weakness: CWE-565.

Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces. Red Hat lists Red Hat Trusted Profile Analyzer as not affected.

Red Hat fixing advisory: RHSA-2026:29017, RHSA-2026:34975.