CVE-2026-92386
server-set cookie aborts cookie jar load
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
| Vendor | curl |
| Product | curl |
| Published | Oct 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for curl curl
Be the first to know when new unknown vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
curl / curl
8.22.0 ≤ 8.22.0 8.21.0 ≤ 8.21.0 8.20.0 ≤ 8.20.0 8.19.0 ≤ 8.19.0 8.18.0 ≤ 8.18.0 8.17.0 ≤ 8.17.0 8.16.0 ≤ 8.16.0 8.15.0 ≤ 8.15.0 8.14.1 ≤ 8.14.1 8.14.0 ≤ 8.14.0 8.13.0 ≤ 8.13.0 8.12.1 ≤ 8.12.1 8.12.0 ≤ 8.12.0 8.11.1 ≤ 8.11.1 8.11.0 ≤ 8.11.0 8.10.1 ≤ 8.10.1 8.10.0 ≤ 8.10.0 8.9.1 ≤ 8.9.1 8.9.0 ≤ 8.9.0 8.8.0 ≤ 8.8.0 8.7.1 ≤ 8.7.1 8.7.0 ≤ 8.7.0
References
Credits
Joshua Rogers (Aisle Research) Daniel Stenberg