CVE-2026-8924
CVE-2026-8924: 2 tracked advisory records across NetApp, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
NetApp
1 advisory- Advisory severityCritical9.1
Critical [CVE-2026-8924] Libcurl Vulnerability in NetApp Products
NTAP-20260731-0006Source published Source updated
Libcurl versions 7.46.0 prior to 8.21.0 are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information or addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 7.46.0
- 8.21.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-8924] Cookie injection via malicious HTTP server using super cookies
CVE-2026-8924Source published Source updated
A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains. Moderate: Red Hat rates this flaw Moderate (CVSS 6.5) compared to CISA's Critical (9.1). The scoring difference is due to two factors: first, exploitation requires the victim's curl to connect using a trailing-dot hostname (e.g.,.), a format that is uncommon in practice and incompatible with TLS SNI; second, the direct impact is cookie injection into outbound requests — not exfiltration of victim data to the attacker. The curl project itself rates this flaw Low severity. Red Hat products that use curl for HTTP…
- Affected products in this advisory
- Red Hat Enterprise Linux 10
- Red Hat Hardened Images
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
6 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- curl-0:8.12.1-4.el10_2.6
- curl-main-8.21.0-0.1.hum1
- rust-main-1.96.1-1.hum1
- RHSA-2026:69125
2 more entries in the full advisory.
- Mitigation guidance
- Do not use trailing-dot hostnames in URLs passed to curl. Trailing dots are uncommon and incompatible with TLS SNI. Upgrade to curl 8.21.0 to resolve
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.