CVE-2026-92386
highWhen writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing li…
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://curl.se/docs/CVE-2026-92386.html 2499f714-1537-4658-8207-48ae4bb9eae9
- https://curl.se/docs/CVE-2026-92386.json 2499f714-1537-4658-8207-48ae4bb9eae9
- https://hackerone.com/reports/4021979 2499f714-1537-4658-8207-48ae4bb9eae9
- https://hackerone.com/reports/4021979 134c704f-9b21-4f2e-91b3-4a467353bcc0

