REDHAT-BUG-2496765: Medium severity curl curl vulnerability

Published Jul 3, 2026

Updated

A flaw in curl’s cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.

Affected Software

1 affected component

curl curl

Event History

Jul 3, 2026

Data Sourced

via Red Hat·07:01 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

The attacker needs to operate or control an HTTP server that curl accesses, so it can set a malicious cookie. Curl must later make requests where the injected cookie can be transmitted to unrelated third-party domains.

Which curl uses are most exposed?

Uses that accept cookies from attacker-controlled HTTP origins and subsequently reuse the cookie store while contacting other domains are exposed to the described cross-domain cookie injection risk.

REDHAT-BUG-2496765: Medium severity curl curl vulnerability

Affected Software

Event History

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which curl uses are most exposed?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to do to exploit this issue?

Which curl uses are most exposed?