Improper Validation of Specified Quantity in Input in cURL - CVE-2026-92386
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.
The vulnerability exists due to improper validation of cookie record length in the Netscape cookie jar writer and parser when writing server-supplied cookies and subsequently loading the cookie jar. A remote attacker can supply a long cookie name and value through an HTTP server response to prematurely terminate cookie jar parsing, causing subsequent valid cookies to be ignored.
Exploitation requires a subsequent invocation to read the same cookie jar using --cookie. The server cannot determine or control the cookie's relative position in the jar, so the oversized record may affect many, few, or no other cookies.