CVE-2026-86412

Published: Oct 20, 2026Modified: Oct 29, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

Related CWEs

CWE-754

Improper Check for Unusual or Exceptional Conditions

The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.

References (4)

https://curl.se/docs/CVE-2026-86412.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://curl.se/docs/CVE-2026-86412.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://hackerone.com/reports/3973201

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://hackerone.com/reports/3973201

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.