server-set cookie erases cookie jar
===================================

Project curl Security Advisory, October 14 2026
[Permalink](https://curl.se/docs/CVE-2026-86412.html)

VULNERABILITY
-------------

A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape cookie jar but cannot reload. On the next invocation using the same
path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the
cleanup procedure replaces the jar with an empty file, deleting cookies for
unrelated domains.

INFO
----

The root cause is that curl can accept a cookie over the wire and store it in
its cookie file, but refuse to later load it because of size constraints. When
a single cookie entry is considered problematic, the entire cookie load
process was abandoned. The subsequent cookie store operation then writes the
file with a partial set, erasing cookies that were otherwise assumed to
remain.

A cookie with a 4094-byte name, value `v`, and `Path=/` followed by 870 `a`
characters, set by a 16-byte host (`attacker.example`), serializes to a
4999-byte cookie jar record. This is refused to load because curl has a 5000
byte line limit minus the newline and a null terminator.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2026-86412 to this issue.

CWE-754: Improper Check for Unusual or Exceptional Conditions

Severity: Low

AFFECTED VERSIONS
-----------------

- Affected versions: curl 8.18.0 to and including 8.22.0
- Not affected versions: curl < 8.18.0 and >= 8.23.0
- Introduced-in: https://github.com/curl/curl/commit/3f0629ca443825916cbc0795

libcurl is used by many applications, but not always advertised as such!

This flaw also affects the curl command line tool.

SOLUTION
------------

- Fixed-in: https://github.com/curl/curl/commit/6ded3e594455d6f018fab5f2f5d91

RECOMMENDATIONS
--------------

 A - Upgrade curl to version 8.23.0

 B - Apply the patch to your local version

 C - Do not use cookies

TIMELINE
--------

This issue was reported to the curl project on August 27, 2026.

curl 8.23.0 was released on October 14, 2026, coordinated with the publication
of this advisory.

CREDITS
-------

- Reported-by: Stanislav Fort (Aisle Research)
- Patched-by: Daniel Stenberg

Thanks a lot!