Improper Check for Unusual or Exceptional Conditions in cURL - CVE-2026-86412
Published: October 14, 2026
Vulnerability details
The vulnerability allows a remote attacker to delete cookies for unrelated domains and cause a denial of service.
The vulnerability exists due to improper handling of exceptional cookie size conditions in curl's cookie jar loading and cleanup procedures when reloading a stored cookie that exceeds the cookie file line limit. A remote attacker can serve a specially crafted HTTP cookie that curl accepts and stores but subsequently refuses to reload to delete cookies for unrelated domains and cause a denial of service.
Exploitation requires a subsequent curl invocation using the same file path for --cookie and --cookie-jar. That invocation fails before connecting, and cleanup replaces the cookie jar with an empty file.