CVE-2026-92386

Awaiting Analysis Awaiting Analysis - Queue

curl Cookie Parsing Buffer Overflow via Long Cookie Values

Publication date: 2026-10-20

Last updated on: 2026-10-29

Assigner: curl

Description

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-29

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-92386

Affected Vendors & Products

Vendor	Product	Version / Range
curl	curl	8.22.0
curl	curl	8.21.0
curl	curl	8.20.0
curl	curl	8.19.0
curl	curl	8.18.0
curl	curl	8.17.0
curl	curl	8.16.0
curl	curl	8.15.0
curl	curl	8.14.1
curl	curl	8.14.0
curl	curl	8.13.0
curl	curl	8.12.1
curl	curl	8.12.0
curl	curl	8.11.1
curl	curl	8.11.0
curl	curl	8.10.1
curl	curl	8.10.0
curl	curl	8.9.1
curl	curl	8.9.0
curl	curl	8.8.0
curl	curl	8.7.1
curl	curl	8.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability occurs when a remote HTTP server writes a very long cookie name and value to a Netscape cookie jar file. When curl later reads this file using the --cookie option, it fails to parse lines exceeding its limit, causing it to stop reading prematurely and ignore valid cookies that follow.

Detection Guidance

Check curl cookie jar files for excessively long lines using commands like 'grep -n . ~/.curlrc' or 'awk 'length>512' ~/.curlrc'. If lines exceed 512 characters, the vulnerability may be present.

Impact Analysis

If you use curl to read cookies from a compromised jar file, subsequent curl commands may fail to process valid cookies, leading to incorrect behavior in applications relying on those cookies. This could disrupt sessions or cause unexpected errors.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to cookie parsing in curl. However, if curl is used in systems handling sensitive data under these regulations, improper cookie handling could lead to data exposure or processing errors, potentially impacting compliance indirectly.

Mitigation Strategies

Delete or truncate overly long cookie entries in curl cookie jar files. Avoid writing long cookie names or values to Netscape cookie jars. Update curl to a patched version if available.

Hi! I’m here to help you understand CVE-2026-92386. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...