curl / Docs / curl CVEs / server-set cookie erases cookie jar
Related:
Audits
Changelog
curl CVEs
JSON metadata
Original report
Vulnerability Disclosure
Vulnerabilities Table

CVE-2026-86412

server-set cookie erases cookie jar

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

INFO

The root cause is that curl can accept a cookie over the wire and store it in its cookie file, but refuse to later load it because of size constraints. When a single cookie entry is considered problematic, the entire cookie load process was abandoned. The subsequent cookie store operation then writes the file with a partial set, erasing cookies that were otherwise assumed to remain.

A cookie with a 4094-byte name, value v, and Path=/ followed by 870 a characters, set by a 16-byte host (attacker.example), serializes to a 4999-byte cookie jar record. This is refused to load because curl has a 5000 byte line limit minus the newline and a null-terminator.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-86412 to this issue.

CWE-754: Improper Check for Unusual or Exceptional Conditions

Severity: Low

AFFECTED VERSIONS

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Do not use cookies

TIMELINE

This issue was reported to the curl project on August 27, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!