{"id":"CVE-2026-86412","kind":"vulnerability","aliases":["CVE-2026-86412"],"related":[],"title":"curl: remote server cookie can wipe unrelated cookies from jar file","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains.","summary":"A remote HTTP server can set a cookie that curl writes to a Netscape cookie jar file but cannot read back. On the next run using the same path for --cookie and --cookie-jar, curl fails and then replaces the jar with an empty file, deleting cookies for other domains.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ci","cli","curl","package","scripts"],"not_affected_if":["no-cookie-jar","separate-cookie-paths"],"how_to_check":"- Run `curl --version` and compare against the fixed release in the sources, which the sources do not name: unknown\n- Search scripts for `--cookie-jar` and `--cookie` pointing at the same file path","fix":"- Upgrade curl to a release that fixes CVE-2026-86412: unknown\n- Until then, use different file paths for `--cookie` and `--cookie-jar`","status":"open","published_at":"2026-10-20T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","triaged_at":"2026-10-25T05:04:35+00:00","updated_at":"2026-10-25T05:04:35+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:04:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade curl to a release that fixes CVE-2026-86412: unknown\n- Until then, use different file paths for `--cookie` and `--cookie-jar`","reach":"internet","title":"curl: remote server cookie can wipe unrelated cookies from jar file","impact":"low","summary":"A remote HTTP server can set a cookie that curl writes to a Netscape cookie jar file but cannot read back. On the next run using the same path for --cookie and --cookie-jar, curl fails and then replaces the jar with an empty file, deleting cookies for other domains.","category":"package","nicknames":[],"who_cares":["curl","cli","scripts","ci"],"confidence":0.6,"needs_auth":"no","worst_case":"Cookies for unrelated domains are deleted from the jar file","analyst_note":"Confirm the fixed curl version and the affected version range from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-86412 or the curl advisory.","how_to_check":"- Run `curl --version` and compare against the fixed release in the sources, which the sources do not name: unknown\n- Search scripts for `--cookie-jar` and `--cookie` pointing at the same file path","needs_analyst":true,"not_affected_if":["separate-cookie-paths","no-cookie-jar"],"who_is_affected":"Scripts or tools that run curl with the same file passed to both --cookie and --cookie-jar, and that talk to HTTP servers that might be hostile or compromised. Runs that use separate paths for reading and writing cookies, or that never store cookie jars, are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00063,"input_tokens":3329,"output_tokens":594,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86412':14A,17A 'accept':84C 'back':43B 'cannot':41B,93C 'ci':18B 'cleanup':115C 'cli':19B 'connect':112C 'cooki':4A,8A,30B,37B,53B,56B,70B,81C,90C,104C,107C,125C 'cookie-jar':55B,106C 'curl':1A,20B,32B,58B,83C,109C 'cve':12A,15A 'delet':69B,124C 'domain':73B,128C 'empti':67B,122C 'fail':59B,110C 'file':11A,39B,68B,123C 'http':25B,76C 'invoc':98C 'jar':10A,38B,57B,64B,91C,108C,119C 'netscap':36B,89C 'next':46B,97C 'packag':21B 'path':51B,102C 'procedur':116C 'read':42B 'reload':94C 'remot':2A,24B,75C 'replac':62B,117C 'run':47B 'script':22B 'server':3A,26B,77C 'set':28B,79C 'unrel':7A,127C 'use':48B,99C 'wipe':6A 'write':33B,86C","nicknames":[],"mitigations":[],"who_affected":"Scripts or tools that run curl with the same file passed to both --cookie and --cookie-jar, and that talk to HTTP servers that might be hostile or compromised. Runs that use separate paths for reading and writing cookies, or that never store cookie jars, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","severity":null,"published_at":"2026-10-20T20:17:25+00:00","modified_at":"2026-10-22T17:21:57+00:00","first_seen_at":"2026-10-23T21:57:21+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}