CVE-2026-8924Disclosure(haxx / curl)

#IBMAIX ■ Security Bulletin: Multiple vulnerabilities impact AIX due to CURL libcurl (CVE-2026-10536, CVE-2026-11856, CVE-2026-8286, CVE-2026-8458, CVE-2026-8924, CVE-2026-8927, CVE-2026-8932, CVE-2026-9547). https://www.ibm.com/support/pages/node/7281743 沢山あります！ 😱

🚨 CRITICAL - curl "super cookie" injection via PSL bypass (CVE-2026-8924) CVE-2026-8924 is a flaw in curl’s cookie parsing/handling logic that lets a malicious HTTP server set cookies in a way that bypasses the Public Suffix List (PSL) restriction checks. The root cause is improper input validation in cookie domain scoping, allowing crafted cookie attributes to evade PSL enforcement. An attacker exploits this by operating or intercepting an HTTP(S) origin you connect to, then returning a Set-Cookie header that curl accepts and later replays to other unrelated domains during subsequent requests. Real-world impact includes cross-domain cookie injection and leakage, session fixation, and credential/token exposure when curl sends attacker-planted cookies to third-party services. 👉 Affected: curl (versions with vulnerable cookie parsing logic; see vendor advisory for exact range) | Upgrade to fixed curl release once available (No fix yet - treat as suspicious)