UBUNTU-CVE-2026-92386: High severity ubuntu/curl vulnerability

Q: Who is exposed to this issue?

Systems using curl with a Netscape-format cookie jar are exposed if curl writes cookies received from a remote HTTP server and later reads the same jar with --cookie. The impact occurs when a long cookie name and value cause a record to exceed curl's line-length parsing limit.

Q: What does an attacker need to do to trigger the problem?

A remote HTTP server needs to cause curl to store an excessively long cookie name and value in the Netscape cookie jar. A later curl invocation must then read that same cookie jar using --cookie.

Q: Are subsequent cookies still used after the malformed record?

No. When curl encounters the overlong cookie-jar line, it silently stops parsing the file and ignores all valid cookies that follow that line.

Q: How can I determine whether a cookie jar is affected?

Inspect Netscape cookie jar files for unusually long cookie records, especially entries written after contacting remote HTTP servers. Affected behavior is indicated when curl using --cookie stops recognizing cookies located after an overlong line.

Published Oct 14, 2026

Updated

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

Affected Software

2 affected componentsFixes available

ubuntu/curl<8.20.0-2ubuntu11.1

8.20.0-2ubuntu11.1

ubuntu/curl<8.18.0-1ubuntu2.8

8.18.0-1ubuntu2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.20.0-2ubuntu11.1
Upgrade
Upgrade ubuntu/curl to a version that resolves this vulnerability.
Fixed in 8.18.0-1ubuntu2.8

Event History

Oct 14, 2026

CVE Published

via OSV·06:00 AM

Data Sourced

via OSV·06:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems using curl with a Netscape-format cookie jar are exposed if curl writes cookies received from a remote HTTP server and later reads the same jar with --cookie. The impact occurs when a long cookie name and value cause a record to exceed curl's line-length parsing limit.

What does an attacker need to do to trigger the problem?

A remote HTTP server needs to cause curl to store an excessively long cookie name and value in the Netscape cookie jar. A later curl invocation must then read that same cookie jar using --cookie.

Are subsequent cookies still used after the malformed record?

No. When curl encounters the overlong cookie-jar line, it silently stops parsing the file and ignores all valid cookies that follow that line.

How can I determine whether a cookie jar is affected?

Inspect Netscape cookie jar files for unusually long cookie records, especially entries written after contacting remote HTTP servers. Affected behavior is indicated when curl using --cookie stops recognizing cookies located after an overlong line.

UBUNTU-CVE-2026-92386: High severity ubuntu/curl vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the problem?

Are subsequent cookies still used after the malformed record?

How can I determine whether a cookie jar is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the problem?

Are subsequent cookies still used after the malformed record?

How can I determine whether a cookie jar is affected?