curl - server-set cookie aborts cookie jar load

curl / Docs / curl CVEs / server-set cookie aborts cookie jar load

CVE-2026-92386

Project curl Security Advisory, October 14 2026 Permalink

VULNERABILITY

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

INFO

The server cannot know or impact the relative position of this particular cookie in the cookie jar, thus this flaw may affect many, few or no other cookies when triggered.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-92386 to this issue.

CWE-1284: Improper Validation of Specified Quantity in Input

Severity: Low

AFFECTED VERSIONS

Affected versions: curl 8.7.0 to and including 8.22.0
Not affected versions: curl < 8.7.0 and >= 8.23.0
Not affected versions: curl >= 8.20.2 in the 8.20.X branch
Not affected versions: curl >= 8.16.2 in the 8.16.X branch
Not affected versions: curl >= 8.14.3 in the 8.14.X branch
Introduced-in: https://github.com/curl/curl/commit/142ac257b3242459b2840

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION

Fixed-in: https://github.com/curl/curl/commit/445aa87e13f91c94bc742f5434

RECOMMENDATIONS

A - Upgrade curl to version 8.23.0

B - Apply the patch to your local version

C - Do not use cookies

TIMELINE

This issue was reported to the curl project on September 11, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication of this advisory.

CREDITS

Reported-by: Joshua Rogers (Aisle Research)
Patched-by: Daniel Stenberg

Thanks a lot!