Curl 8.18.0 < 8.23.0 Cookie Jar Erasure

The version of curl installed on the remote host is 8.18.0 prior to 8.23.0. It is, therefore, affected by a data loss vulnerability: - A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for...

Curl 8.7.0 < 8.23.0 Cookie Jar Parsing Issue

The version of curl installed on the remote host is 8.7.0 prior to 8.23.0. It is, therefore, affected by a cookie jar vulnerability: - When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit...

CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

ALPINE-CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

AZL-109899 CVE-2026-92386 affecting package cmake 3.30.3-15

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

AZL-109977 CVE-2026-92386 affecting package curl 8.11.1-12

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

AZL-110016 CVE-2026-92386 affecting package mysql 8.0.46-2

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

AZL-110151 CVE-2026-92386 affecting package rust 1.75.0-31

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

AZL-110250 CVE-2026-92386 affecting package rust 1.96.1-2

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

DEBIAN-CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

CVE-2026-92386 server-set cookie aborts cookie jar load

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

EUVD-2026-105315

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make "curl" write a record that exceeds its line-length parsing limit. Consequently, any subsequent "curl" invocation reading from that same cookie jar using "--cookie" silently aborts parsing prematurely...

CVE-2026-92386

The curl utility (versions prior to 8.23.0 ) is vulnerable to a cookie jar parsing issue (CWE-1284). A remote HTTP server can force curl to write a record to a Netscape cookie jar that exceeds its line-length parsing limit. This causes subsequent curl invocations using the --cookie flag to silent...

CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

ALPINE-CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

AZL-110166 CVE-2026-86412 affecting package rust 1.75.0-31

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

AZL-110259 CVE-2026-86412 affecting package rust 1.96.1-2

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...