When writing a long cookie name and value to a Netscape cookie jar, a remote
HTTP server can make `curl` write a record that exceeds its line-length
parsing limit. Consequently, any subsequent `curl` invocation reading from
that same cookie jar using `--cookie` silently aborts parsing prematurely upon
encountering the too long line, ignoring all subsequent valid cookies in the
file.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Curl |
|
No data.
No data.
References
History
Tue, 20 Oct 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. A remote malicious server can trigger a denial of service (DoS) in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort parsing upon encountering the oversized entry, causing all remaining valid cookies in the file to be ignored. | When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file. |
| Title | curl: curl: server-set cookie aborts cookie jar load | server-set cookie aborts cookie jar load |
| References |
|
Sun, 18 Oct 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Curl
Curl curl |
|
| Vendors & Products |
Curl
Curl curl |
Sat, 17 Oct 2026 00:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in curl. A remote malicious server can trigger a denial of service (DoS) in cookie handling by providing an overly long cookie name and value that exceeds curl's line-length limit when saved to a cookie file. Subsequent curl operations reading from this cookie file silently abort parsing upon encountering the oversized entry, causing all remaining valid cookies in the file to be ignored. | |
| Title | curl: curl: server-set cookie aborts cookie jar load | |
| Weaknesses | CWE-1284 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: curl
Published: 2026-10-20T20:17:37.356Z
Updated: 2026-10-20T20:17:37.356Z
Reserved: 2026-09-16T08:12:42.908Z
Link: CVE-2026-92386
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-10-20T21:17:21.017
Modified: 2026-10-22T17:21:57.293
Link: CVE-2026-92386
Redhat