Bug 2550682 (CVE-2026-92386)

Summary:	CVE-2026-92386 curl: curl: server-set cookie aborts cookie jar load
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	anthomas, csutherl, ehelms, ggainey, jclere, jpasqual, juwatts, mdellweg, mhulan, nmoumoul, osousa, pcreech, pjindal, plodge, rchan, rekumar, rhel-process-autobot, security-response-team, smallamp, szappis, tmalecek, vchlup, vvoronko, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in curl. A remote malicious server can trigger a denial of service (DoS) in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort parsing upon encountering the oversized entry, causing all remaining valid cookies in the file to be ignored.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2026-10-14

Description OSIDB Bzimport 2026-10-13 16:41:59 UTC

server-set cookie aborts cookie jar load
========================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-92386.html)

VULNERABILITY
-------------

When writing a long cookie name and value to a Netscape cookie jar, a remote
HTTP server can make `curl` write a record that exceeds its line-length
parsing limit. Consequently, any subsequent `curl` invocation reading from
that same cookie jar using `--cookie` will silently abort parsing prematurely
upon encountering the oversized line, ignoring all subsequent valid cookies in
the file.

INFO
----

The server cannot know or impact the relative position of this particular
cookie in the cookie jar, thus this flaw may affect many, few or no other
cookies when triggered.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-92386 to this issue.

CWE-1284: Improper Validation of Specified Quantity in Input

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.7.0 to and including 8.22.0
- Not affected versions: curl < 8.7.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/142ac257b3242459b2840

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/445aa87e13f91c94bc742f5434

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not use cookies

TIMELINE
--------

This issue was reported to the curl project on September 11, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Joshua Rogers (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!