CVE-2026-86412: server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u5Fixed in 8.14.1-2+deb13u7Fixed in 8.23.0-1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0
Event History
Frequently Asked Questions
Which curl usage pattern is affected?
The issue affects use of the same file path for both --cookie and --cookie-jar across invocations. A cookie jar containing the server-set cookie is written successfully, but curl cannot reload it on the next use.
What must an attacker control to trigger the loss of stored cookies?
An attacker needs to operate or control a remote HTTP server that can send a cookie curl accepts and writes to the Netscape cookie jar, but cannot subsequently reload. The impact occurs when curl later uses that jar as both its input cookie file and output cookie jar.
How would an operator notice that the issue has occurred?
On the next curl invocation using the affected jar, curl fails before connecting. Its cleanup then replaces the cookie jar with an empty file, so cookies for unrelated domains are no longer present.