curl: Cookie jar erased by unloadable server-set cookie

Summary

The curl command-line tool and libcurl versions 8.18.0 to 8.22.0 are affected. A remote HTTP server can set a cookie that curl stores in a Netscape cookie jar but cannot reload. If a later run uses the same file for --cookie and --cookie-jar, curl aborts before connecting and then replaces the jar with an empty file, deleting cookies for unrelated domains. The attack requires that the affected automation contacts an attacker-controlled HTTP server.

Affected

• curl 8.18.0 to and including 8.22.0
• curl 8.20.x branch before 8.20.2
• Not affected: curl before 8.18.0 and 8.23.0 or later
• Default configuration: unaffected per the vendor's CVE record
• Only scripts or jobs using the same path for --cookie and --cookie-jar are affected

Fixed in

• curl 8.23.0 (vendor fix, commit 6ded3e5)
• curl 8.20.2 for the 8.20.x branch
• Ubuntu 26.04 LTS: 8.18.0-1ubuntu2.8 (per research notes; verify with Ubuntu advisory)
• Debian bookworm and trixie: fixed per Debian tracker
• Debian forky (8.22.0-1): still vulnerable
• Note: curl 8.23.0 removes SMB and SMBS protocol support; test compatibility before deployment

Workaround

• Use separate files for --cookie and --cookie-jar in scripts (own inference, not a vendor statement)
• Back up cookie jar files before running affected jobs
• Unknown for unpatched builds such as Debian forky; no vendor-approved workaround found beyond the upgrade or local patch

Exploitation

• No evidence of exploitation in the wild found (OffSeq: not known to be exploited)
• No public exploit found in Metasploit or Exploit-DB (third-party sources, absence is not proof)
• CISA SSVC in the official CVE record lists Exploitation: poc and Automatable: no; this conflicts with the absence of public PoC evidence
• Vendor rates severity Low; NVD analysis is still awaiting, and NVD's 8.1 score is unverified

Our recommendation

• Upgrade curl to 8.23.0 or to your distribution's fixed build in the routine patch cycle
• Check scripts, backups and CI jobs for the shared --cookie and --cookie-jar path pattern
• Prioritise hosts running curl in automated jobs against untrusted HTTP endpoints
• Back up cookie jar files and test SMB/SMBS dependencies before upgrading
• No urgent action beyond normal patching is indicated for typical desktops

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• curl security advisory CVE-2026-86412 curl.se
• curl CVE JSON metadata (OSV format) curl.se
• Original HackerOne report hackerone.com
• Ubuntu security notice CVE-2026-86412 ubuntu.com
• Debian security tracker for curl security-tracker.debian.org
• OSV entry CURL-CVE-2026-86412 osv.dev
• VulDB entry 422989 vuldb.com
• OffSeq threat radar entry radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:38.