CVE-2026-92386: server-set cookie aborts cookie jar load
Last updated 19 October 2026
Other sources
server-set cookie aborts cookie jar load
— Microsoft
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.20.0-2ubuntu11.1 - Upgrade
Upgrade
ubuntu/curlto a version that resolves this vulnerability.Fixed in 8.18.0-1ubuntu2.8 - Upgrade
Upgrade
alpine/curlto a version that resolves this vulnerability.Fixed in 8.23.0-r0 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.88.1-10+deb12u15Fixed in 7.88.1-10+deb12u5Fixed in 8.23.0-1
Event History
Frequently Asked Questions
Which curl workflows are exposed to this issue?
Workflows are exposed when curl writes cookies received from a remote HTTP server to a Netscape-format cookie jar and a later curl invocation loads that same file with --cookie. A server able to set an unusually long cookie name and value can place the problematic record in the jar.
What is the operational impact after a malformed cookie record is present?
When curl encounters the overlong record while loading the cookie jar, it silently stops parsing the file. Valid cookie entries located after that record are ignored by subsequent curl invocations.