IT SBIT Services
Schneeberger
DEEN
CVE tracker

curl: Improper validation of cookie record length in Netscape cookie jar

CVE-2026-92386High 8.1

← All vulnerabilities

Summary

curl writes a cookie to a Netscape-format cookie jar with a name and value that together exceed the tool's line-length parsing limit. A remote HTTP server can trigger this by setting a long cookie. Any later curl run that reads that jar with --cookie stops parsing at the oversized line and ignores all valid cookies after it. The vendor rates this as Low: it affects integrity and availability of cookie-based scripts and automation, not code execution or data theft.

Affected

  • curl 8.7.0 through 8.22.0 (libcurl and the curl command line tool)
  • Not affected: curl versions before 8.7.0 and 8.23.0 or later
  • Per the advisory, the 8.14.X, 8.16.X and 8.20.X branches are not affected from 8.14.3, 8.16.2 and 8.20.2 onwards
  • Distributions vary, for example Ubuntu 26.04 LTS (8.18.0-1ubuntu2.8 fixed) and Debian trixie (8.14.1-2+deb13u7 still vulnerable at the time of research); check your distribution advisory

Fixed in

  • curl 8.23.0 (released 14 October 2026, fix commit 445aa87)
  • Branch fixes per the advisory: 8.14.3, 8.16.2, 8.20.2
  • Distribution backports: check your vendor's advisory

Workaround

  • Vendor options: upgrade to 8.23.0, apply the upstream patch to a local build, or do not use cookies
  • Unofficial inference: do not share one cookie jar between scripts or trust boundaries, and do not reuse a jar that a client fetched from an untrusted server

Exploitation

  • Exploited in the wild: Unknown. No reports found.
  • Public proof of concept: none found in research. CISA SSVC lists exploitation as poc and automatable as no.
  • Finder: Joshua Rogers (Aisle Research); report on HackerOne.

Our recommendation

  • Find hosts and containers with curl or libcurl below 8.23.0, including builds from source and bundled copies in applications.
  • Check your distribution's security advisories for backported fixes.
  • Patch in the normal update cycle, as the vendor rates the risk Low.
  • Prioritise hosts that run cookie-jar automation against untrusted endpoints, and separate cookie jars per job or trust boundary.
  • Note that the CVSS 8.1 in the record does not match other sources (5.4 and 5.9) or the vendor's Low rating; use the vendor rating for prioritisation.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:32.

Original description (NVD)

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

NVD references (4)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed