curl: CVE-2026-86412: server-set cookie erases cookie jar

Summary A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails with CURLETOOLARGE 100 before connecting, then cleanup replaces the jar with an empty 131-byt...

curl: Cookie attribute TAB injection regression in Set-Cookie parsing

Overview | | | |---|---| | Component | lib/cookie.c — parsecookieheader | | Type | Security regression incomplete input validation | | CWE | CWE-20 Improper Input Validation | | Severity | LOW CVSS 3.1 estimated 3.7, comparable to CVE-2022-35252 | | Affected | curl 8.18.0 through current HEAD | |...

HTTP cookies import

This plugin imports cookies for all web tests. The cookie file must be in 'Netscape format'. It does not perform any test by itself. TRUSTED...