CVE-2026-86412

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description A remote HTTP server can set a cookie that is accepted and written to a Netscape cookie jar but cannot be reloaded. When curl is subsequently invoked using the same path for the --cookie and --cookie-jar parameters, the application fails before establishing a connection. During the cleanup procedure, curl replaces the cookie jar with an empty file, which results in the deletion of cookies for unrelated domains.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.