{"id":"CURL-CVE-2026-86412","summary":"server-set cookie erases cookie jar","details":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains.","aliases":["CVE-2026-86412"],"modified":"2026-10-14T07:04:26.202347504Z","published":"2026-10-14T08:00:00Z","database_specific":{"URL":"https://curl.se/docs/CVE-2026-86412.json","www":"https://curl.se/docs/CVE-2026-86412.html","issue":"https://hackerone.com/reports/3973201","CWE":{"desc":"Improper Check for Unusual or Exceptional Conditions","id":"CWE-754"},"last_affected":"8.22.0","severity":"Low","package":"curl","affects":"both"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.18.0"},{"fixed":"8.23.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"3f0629ca443825916cbc0795bcd5f241fbf7104c"},{"fixed":"6ded3e594455d6f018fab5f2f5d916eb9bc4ef94"}]}],"versions":["8.22.0","8.21.0","8.20.0","8.19.0","8.18.0","curl-8_22_0","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1"],"database_specific":{"source":"https://curl.se/docs/CURL-CVE-2026-86412.json","vanir_signatures":[{"digest":{"function_hash":"36248945617882343126496426670113368036","length":1393},"id":"CURL-CVE-2026-86412-6f05fb09","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/6ded3e594455d6f018fab5f2f5d916eb9bc4ef94","target":{"function":"cookie_load","file":"lib/cookie.c"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["267223874941213734843465484783740111605","74711443983954957779723069113130742241","313822692705061251465513766519671457736"],"threshold":0.9},"id":"CURL-CVE-2026-86412-ac4b8286","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/6ded3e594455d6f018fab5f2f5d916eb9bc4ef94","target":{"file":"lib/cookie.c"}}],"vanir_signatures_modified":"2026-10-14T07:04:26Z"}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Daniel Stenberg","type":"REMEDIATION_DEVELOPER"}]}