CVE-2026-86412: curl Information Disclosure Vulnerability

CVE-2026-86412 Overview

CVE-2026-86412 affects curl, the widely-used command-line HTTP client and library. A remote HTTP server can set a cookie that curl accepts and writes to a Netscape-format cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting. The cleanup procedure then replaces the jar with an empty file, deleting cookies for unrelated domains.

This flaw allows a malicious server to indirectly destroy stored cookies belonging to other domains in the shared cookie jar. The result is loss of persistent session state and potential forced re-authentication across unrelated services.

Critical Impact
A single malicious response can wipe the entire Netscape cookie jar, erasing stored authentication state for every domain the user interacts with via curl.

Affected Products

curl (command-line tool)
libcurl (library)
Applications and scripts using curl with shared --cookie and --cookie-jar paths

Discovery Timeline

2026-10-20 - CVE-2026-86412 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-86412

Vulnerability Analysis

The defect lies in how curl handles the Netscape-format cookie jar lifecycle. When a remote server sends a Set-Cookie header that curl accepts and writes to disk, that same cookie line can later be rejected during the parse phase on reload. Because curl exits before connecting on parse failure, the subsequent cleanup routine opens the jar for writing and truncates it. All cookies for unrelated domains are lost.

The impact extends beyond the originating site. Any domain whose cookies share the Netscape jar file loses persistent state. Users may be forcibly logged out, scripts may fail authentication, and automation relying on long-lived session cookies may break silently.

Root Cause

The root cause is an inconsistency between the cookie writer and the cookie parser. Curl accepts cookie values that its Netscape jar reader rejects. When reload fails, the cleanup path does not preserve the existing file. Instead, it overwrites the jar with an empty representation of in-memory state, which at that moment contains no cookies.

Attack Vector

An attacker controlling or compromising any HTTP server contacted by curl can trigger this condition. The attacker crafts a Set-Cookie response the writer accepts but the reader cannot parse. The jar is corrupted on write, and subsequent invocations wipe it. No authentication to the target or user interaction beyond the normal curl request is required.

For technical details, see the cURL CVE-2026-86412 Documentation and the HackerOne Report #3973201.

Detection Methods for CVE-2026-86412

Indicators of Compromise

Netscape cookie jar files that have been unexpectedly truncated to zero bytes or contain only the Netscape header.
curl exit codes indicating cookie parsing or load failure prior to any network connection attempt.
Automation jobs or scripts reporting sudden loss of authenticated sessions across multiple unrelated domains.

Detection Strategies

Monitor file integrity on known curl cookie jar paths used by service accounts and automation.
Audit curl invocations in shell history, cron jobs, and CI/CD pipelines where the same path is passed to both --cookie and --cookie-jar.
Correlate web application re-authentication spikes with cookie jar modification timestamps on client systems.

Monitoring Recommendations

Enable file access auditing on cookie jar paths and alert on size reductions.
Capture curl stderr output in automation to detect pre-connect parse failures.
Track installed curl versions across endpoints and servers to confirm patched builds are deployed.

How to Mitigate CVE-2026-86412

Immediate Actions Required

Upgrade curl and libcurl to the fixed release referenced in the cURL CVE-2026-86412 Documentation.
Inventory scripts and services that pass the same path to --cookie and --cookie-jar and review their cookie handling.
Back up existing Netscape cookie jars before resuming use with untrusted endpoints.

Patch Information

Refer to the official curl advisory at curl.se for the fixed version and patch commit. The structured advisory data is available in the cURL CVE-2026-86412 JSON Data.

Workarounds

Use separate paths for --cookie (input) and --cookie-jar (output) so a corrupted output file does not destroy stored input cookies.
Avoid sharing a single Netscape cookie jar across requests to untrusted or multi-tenant endpoints.
Prefer per-session, short-lived cookie jars for curl invocations against external services, and treat the jar file as untrusted input on reload.

bash

# Separate input and output cookie files to limit blast radius
curl --cookie /path/to/session-in.txt \
     --cookie-jar /path/to/session-out.txt \
     https://example.com/