Curl Cookie Jar Empty on Subsequent Calls via Malicious Server
CVE-2026-86412 Published on October 20, 2026
server-set cookie erases cookie jar
A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape cookie jar but cannot reload. On the next invocation using the same
path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the
cleanup procedure replaces the jar with an empty file, deleting cookies for
unrelated domains.
Products Associated with CVE-2026-86412
stack.watch emails you whenever new vulnerabilities are published in Canonical Ubuntu Linux or Haxx Curl. Just hit a watch button to start following.
Affected Versions
curl:- Version 8.22.0, <= 8.22.0 is affected.
- Version 8.21.0, <= 8.21.0 is affected.
- Version 8.20.0, <= 8.20.0 is affected.
- Version 8.19.0, <= 8.19.0 is affected.
- Version 8.18.0, <= 8.18.0 is affected.