Cookie Management Flaw in cURL Affects Remote HTTP Operations from cURL Software Foundation
CVE-2026-86412
Currently unrated
What is CVE-2026-86412?
A security issue in cURL allows a remote HTTP server to set cookies that are accepted and saved in a Netscape cookie jar. However, cURL is unable to reload these cookies on subsequent invocations using the same cookie path. This leads to a failure before connecting when retrying with the same parameters, and during the cleanup process, the jar may be replaced with an empty file, resulting in the loss of cookies for unrelated domains. This vulnerability could potentially disrupt user sessions and data integrity in applications utilizing cURL.
Affected Version(s)
curl 8.22.0
curl 8.21.0
curl 8.20.0