Live › vulnerability › CVE-2026-92386
Go to dashboardA remote HTTP server can send a cookie with a long name and value that curl writes into a Netscape-format cookie jar as an over-long line. Later curl runs reading that jar with --cookie silently stop parsing at that line and ignore the valid cookies after it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams whose scripts or services use curl with a persistent Netscape cookie jar (--cookie-jar and --cookie) against remote servers they do not control. Scripts that use curl without a saved cookie file are unlikely to be affected by this flaw.
No product ranges from the sources yet.
curl --version and compare against the fixed version in the advisory.curl --cookie-jar or --cookie with a shared cookie file.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When writing a long cookie name and value to a Netscape cookie jar, a remote
HTTP server can make curl write a record that exceeds its line-length
parsing limit. Consequently, any subsequent curl invocation reading from
that same cookie jar using --cookie silently aborts parsing prematurely upon
encountering the too long line, ignoring all subsequent valid cookies in the
file.
This page as .md · .json · in your agent: get_signal("CVE-2026-92386")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.