CVE-2026-86412

UNKNOWN 0.0

server-set cookie erases cookie jar

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

Vendor	curl
Product	curl
Published	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new unknown vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.22.0 ≤ 8.22.0 8.21.0 ≤ 8.21.0 8.20.0 ≤ 8.20.0 8.19.0 ≤ 8.19.0 8.18.0 ≤ 8.18.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-86412.json curl.se: https://curl.se/docs/CVE-2026-86412.html hackerone.com: https://hackerone.com/reports/3973201

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg