{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86412", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "state": "PUBLISHED", "assignerShortName": "curl", "dateReserved": "2026-09-07T12:11:50.326Z", "datePublished": "2026-10-20T20:03:28.200Z", "dateUpdated": "2026-10-20T20:03:28.200Z"}, "containers": {"cna": {"title": "server-set cookie erases cookie jar", "descriptions": [{"lang": "en", "value": "A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-10-20T20:03:28.200Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-754 Improper Check for Unusual or Exceptional Conditions"}]}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"version": "8.22.0", "status": "affected", "lessThanOrEqual": "8.22.0", "versionType": "semver"}, {"version": "8.21.0", "status": "affected", "lessThanOrEqual": "8.21.0", "versionType": "semver"}, {"version": "8.20.0", "status": "affected", "lessThanOrEqual": "8.20.0", "versionType": "semver"}, {"version": "8.19.0", "status": "affected", "lessThanOrEqual": "8.19.0", "versionType": "semver"}, {"version": "8.18.0", "status": "affected", "lessThanOrEqual": "8.18.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-86412.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-86412.html", "name": "www"}, {"url": "https://hackerone.com/reports/3973201", "name": "issue"}], "credits": [{"lang": "en", "value": "Stanislav Fort (Aisle Research)", "type": "finder"}, {"lang": "en", "value": "Daniel Stenberg", "type": "remediation developer"}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "curl", "vendor": "curl", "versions": [{"lessThanOrEqual": "8.22.0", "status": "affected", "version": "8.22.0", "versionType": "semver"}, {"lessThanOrEqual": "8.21.0", "status": "affected", "version": "8.21.0", "versionType": "semver"}, {"lessThanOrEqual": "8.20.0", "status": "affected", "version": "8.20.0", "versionType": "semver"}, {"lessThanOrEqual": "8.19.0", "status": "affected", "version": "8.19.0", "versionType": "semver"}, {"lessThanOrEqual": "8.18.0", "status": "affected", "version": "8.18.0", "versionType": "semver"}]}], "source": "2499f714-1537-4658-8207-48ae4bb9eae9"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}], "id": "CVE-2026-86412", "lastModified": "2026-10-22T17:21:57.293", "metrics": {}, "published": "2026-10-20T20:17:25.667", "references": [{"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-86412.html"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://curl.se/docs/CVE-2026-86412.json"}, {"source": "2499f714-1537-4658-8207-48ae4bb9eae9", "url": "https://hackerone.com/reports/3973201"}], "sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9", "vulnStatus": "Awaiting Analysis"}

{"acknowledgement": "Red Hat would like to thank Stanislav Fort (Aisle Research) for reporting this issue.", "bugzilla": {"description": "curl: curl: server-set cookie erases cookie jar", "id": "2550374", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2550374"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-754", "details": ["No description is available for this CVE."], "name": "CVE-2026-86412", "package_state": [{"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "build-of-trustee/trustee-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/a:redhat:confidential_compute_attestation:1", "fix_state": "Not affected", "package_name": "openshift-sandboxed-containers/osc-podvm-payload-rhel9", "product_name": "Confidential Compute Attestation"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "igvm", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "s390utils", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "trustee", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "curl", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "snphost", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "curl", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:jboss_core_services:1", "fix_state": "Not affected", "package_name": "jbcs-httpd24-curl", "product_name": "Red Hat JBoss Core Services"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "foreman", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Fix deferred", "package_name": "openvox-agent", "product_name": "Red Hat Satellite 6"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "puppet-agent", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-14T12:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86412\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86412"], "statement": "This vulnerability is rated as having a Low severity impact because exploitation requires specific non-default invocation options and results strictly in a localized loss of session state rather than code execution or unauthorized data access. In standard Red Hat enterprise environments, curl and libcurl do not preserve HTTP state across executions by default, limiting potential exposure to custom workflows or scripts explicitly configured to maintain persistent cookie stores. Furthermore, successful exploitation requires contacting an untrusted remote endpoint that serves an oversized cookie parameter, causing the application to reset the storage file upon its subsequent run. The resulting impact is confined to session disruption without compromising host integrity or system security.", "threat_severity": "Low"}