CVE-2026-92386

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

CVSS base score
8.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-1284
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

View full NVD advisory →

Published the same day

← Back to CVE watch