Live › vulnerability › CVE-2026-86412
Go to dashboardA remote HTTP server can set a cookie that curl writes to a Netscape cookie jar file but cannot read back. On the next run using the same path for --cookie and --cookie-jar, curl fails and then replaces the jar with an empty file, deleting cookies for other domains.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Scripts or tools that run curl with the same file passed to both --cookie and --cookie-jar, and that talk to HTTP servers that might be hostile or compromised. Runs that use separate paths for reading and writing cookies, or that never store cookie jars, are not affected.
No product ranges from the sources yet.
curl --version and compare against the fixed release in the sources, which the sources do not name: unknown--cookie-jar and --cookie pointing at the same file path--cookie and --cookie-jarEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape cookie jar but cannot reload. On the next invocation using the same
path for --cookie and --cookie-jar, curl fails before connecting, then the
cleanup procedure replaces the jar with an empty file, deleting cookies for
unrelated domains.
This page as .md · .json · in your agent: get_signal("CVE-2026-86412")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.