CVE Feed

    Dashboard / CVE / CVE-2026-86412

    CVE-2026-86412

    A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

    Published:Oct 14, 2026
    Last Modified:Oct 29, 2026
    EPS:Oct 20, 2026
    EPSS Score:0.00266
    CVSS Score:8.1

    Affected Products

    Vendor
    Curl
    Product
    Curl

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-86410 (CVSS 8.1) — A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting …
    CVE-2026-94266 (CVSS 7.5) — libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…
    CVE-2026-87862 (CVSS 8.1) — Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child.…
    CVE-2026-92391 (CVSS 7.5) — A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl dur…
    CVE-2026-86409 (CVSS 8.1) — Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and do…
    CVE-2026-94265 (CVSS 9.1) — When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might er…
    CVE-2026-86415 (CVSS 7.5) — libcurl's connection cache match function never considers the automatic client certificate option, so a cached…
    CVE-2026-87861 (CVSS 9.1) — When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connectio…
    CVE-2026-92387 (CVSS 8.1) — By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can explo…
    CVE-2026-92390 (CVSS 7.5) — When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protect…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High