CVE-2026-86412

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

This vulnerability is rated as having a Low severity impact because exploitation requires specific non-default invocation options and results strictly in a localized loss of session state rather than code execution or unauthorized data access. In standard Red Hat enterprise environments, curl and libcurl do not preserve HTTP state across executions by default, limiting potential exposure to custom workflows or scripts explicitly configured to maintain persistent cookie stores. Furthermore, successful exploitation requires contacting an untrusted remote endpoint that serves an oversized cookie parameter, causing the application to reset the storage file upon its subsequent run. The resulting impact is confined to session disruption without compromising host integrity or system security.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.