CVE-2026-86412: server-set cookie erases cookie jar

Published Oct 20, 2026

Updated

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

Affected Software

1 affected component

curl curl

Event History

Oct 20, 2026

CVE Published

via MITRE·08:03 PM

Data Sourced

via MITRE·08:03 PM

DescriptionWeakness

Data Sourced

via NVD·08:17 PM

Description

Frequently Asked Questions

Which curl usage pattern is affected?

The issue affects use of the same file path for both --cookie and --cookie-jar across invocations. A cookie jar containing the server-set cookie is written successfully, but curl cannot reload it on the next use.

What must an attacker control to trigger the loss of stored cookies?

An attacker needs to operate or control a remote HTTP server that can send a cookie curl accepts and writes to the Netscape cookie jar, but cannot subsequently reload. The impact occurs when curl later uses that jar as both its input cookie file and output cookie jar.

How would an operator notice that the issue has occurred?

On the next curl invocation using the affected jar, curl fails before connecting. Its cleanup then replaces the cookie jar with an empty file, so cookies for unrelated domains are no longer present.

CVE-2026-86412: server-set cookie erases cookie jar

Affected Software

Event History

Frequently Asked Questions

Which curl usage pattern is affected?

What must an attacker control to trigger the loss of stored cookies?

How would an operator notice that the issue has occurred?

Company

Resources

Contact

Frequently Asked Questions

Which curl usage pattern is affected?

What must an attacker control to trigger the loss of stored cookies?

How would an operator notice that the issue has occurred?