Loading story…
curl 8.21.0 fixes multiple security and correctness issues caused by trailing-dot hostname handling, including CVE-2026-8924, a cookie parsing flaw that lets a malicious HTTP server set "super cookies" for public suffix domains. By abusing hostnames such as example.co.uk., an attacker could bypass curl's Public Suffix List validation and cause curl to later send attacker-set cookies to unrelated third-party domains. The vulnerability affects curl versions 7.46.0 through 8.20.0; builds without PSL support are not protected against this class of issue, and the project recommends upgrading to 8.21.0, applying the patch, or avoiding trailing dots in hostnames.
The release also addresses two additional trailing-dot bugs: curl could treat an IPv4 literal with a trailing dot as a hostname rather than an IP address, potentially allowing an incorrect wildcard TLS certificate match, and hostnames with double trailing dots could trigger internal logic errors including HSTS confusion. curl now bans double-trailing-dot names, and the fixes were coordinated through a June disclosure process after the cookie issue was reported by vegagent on HackerOne and patched by Daniel Stenberg.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
A SecurityWeek report published on June 25, 2026 said curl 8.21.0 fixed 18 vulnerabilities, including CVE-2026-8932, an mTLS connection reuse flaw in libcurl that could allow authentication bypass. The report also said the release addressed four medium-severity and 14 low-severity issues, making it curl's largest single CVE patch batch.
On June 24, 2026, Project curl disclosed CVE-2026-8924, a low-severity cookie parsing flaw that lets a malicious HTTP server set super cookies by abusing trailing-dot domains and bypassing Public Suffix List checks. The advisory states the issue affects curl versions 7.46.0 through 8.20.0 and recommends upgrading to 8.21.0 or applying the patch.
curl 8.21.0 was released on June 24, 2026, fixing three trailing-dot hostname handling issues, including the Public Suffix List cookie-domain flaw tracked as CVE-2026-8924. The fixes also addressed an IPv4-literal trailing-dot issue and problems caused by double trailing dots.
Project curl's advisory says the coordinated disclosure process included notifying distros@openwall about CVE-2026-8924 on June 17, 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
16 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcesecurityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcecurl.se
Open sourcecurl.se
Open sourceaisle.com
Open sourcedaniel.haxx.se
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The curl project released **curl/libcurl 8.22.0**, its 276th release, with 302 bug fixes and ten security advisories: nine affecting curl or libcurl and one affecting `wcurl`. The fixes address authentication bypasses, use-after-free conditions, certificate-validation and certificate-pinning bypasses, unsafe connection reuse, and cookie-policy bypasses. The release also adds experimental RFC 9421 HTTP Message Signatures support, prevents NTLM fallback during SPNEGO negotiation, adds Apple-platform support, and removes TLS-SRP support. One advisory, **CVE-2026-80256**, is a medium-severity Windows path-traversal flaw in `wcurl`. Percent-encoded backslashes in a server-influenced output filename can be decoded, allowing a file to be written outside the directory selected by the user. Affected versions include `wcurl` bundled with curl 8.14.0 through 8.21.0 and standalone wcurl 2024.12.08 through 2026.01.05; remediation is to upgrade to curl 8.22.0 or wcurl 2026.08.30, apply the patch, explicitly set output filenames, or disable output-filename percent decoding.
Sep 4, 2026
The curl project released **curl/libcurl 8.20.0** with fixes for several disclosed vulnerabilities that could leak credentials, cookies, or authenticated session state across requests, redirects, proxies, and reused connections. The most broadly exposed issue, **`CVE-2026-6253`**, allows proxy credentials to be forwarded to a different proxy during cross-scheme redirects when separate proxies are configured; it affects **curl and libcurl** from `7.14.1` through `8.19.0`. curl also fixed **`CVE-2026-5545`**, where HTTP(S) connections authenticated with **Negotiate** could be wrongly reused for a different user, potentially sending requests over a connection still authenticated as the first user; that flaw affects versions `7.10.6` through `8.19.0` and also impacts the command-line tool. Additional flaws primarily affect **libcurl** handle and connection reuse. **`CVE-2026-7168`** can leak **Digest proxy authentication state** when the same handle is reused across different HTTP proxies, **`CVE-2026-6429`** can expose **`.netrc` credentials** during HTTP redirects over a reused proxied connection, and **`CVE-2026-6276`** can send cookies for one host to another after reuse of an easy handle with a removed custom `Host:` header. The affected ranges span from `7.12.0` to `8.19.0` depending on the bug, and curl advised users to **upgrade to 8.20.0**, apply the published patches, or avoid risky patterns such as proxy credential use, custom `Host:` headers, `.netrc` with proxied cleartext HTTP, HTTP Negotiate, and handle reuse when switching proxies.
Jun 29, 2026
A critical flaw in Bouncy Castle Java certificate validation, tracked as **CVE-2026-8763**, allows attackers to bypass **Name Constraints** checks by appending a trailing dot to `rfc822Name` and `URI` values in certificates. The bug affects **Bouncy Castle for Java** before `1.85`, **BC-LTS** before `2.73.12`, and **Bouncy Castle FIPS (BC-FJA)** before `1.0.2.7`, `2.0.2`, and `2.1.3`, and carries a **CVSS 4.0 score of 9.3**. The weakness is classified as **CWE-295: Improper Certificate Validation** and is considered remotely exploitable without privileges or user interaction. Project maintainers said the issue stems from inconsistent handling of trailing dots in `PKIXNameConstraintValidator`: `dNSName` values were normalized for comparison, but `rfc822Name` and `URI` values were not, enabling excluded subtree checks to be evaded. An attacker controlling a name-constrained intermediate CA could issue certificates for email addresses or URI hosts that policy should have blocked. The vulnerable path is reachable through the Java 8+ PKIX certificate validation flow, and fixes were released in the patched versions above, including commit `2c28b253a446`.
Aug 5, 2026