Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92386— server-set cookie aborts cookie jar load

Quick assessment

Affected
curl curl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

当向 Netscape 格式的 Cookie 存储文件写入过长的 Cookie 名称和值时，远程 HTTP 服务器可诱导 写入一条超出其行长度解析限制的记录。因此，后续任何使用 选项从该 Cookie 存储文件读取的 调用，在遇到该行过长记录时，会静默地提前终止解析，并忽略文件中该行之后的所有有效 Cookie。

AI Predicted 4.3 Difficulty: Moderate EPSS 0.83% · P57

Possible ATT&CK Techniques 1 AI

T1562.004

Affected Version Matrix 22

VendorProduct Version RangeStatus
curl curl 8.22.0≤ 8.22.0 affected
8.21.0≤ 8.21.0 affected
8.20.0≤ 8.20.0 affected
8.19.0≤ 8.19.0 affected
8.18.0≤ 8.18.0 affected
8.17.0≤ 8.17.0 affected
8.16.0≤ 8.16.0 affected
8.15.0≤ 8.15.0 affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92386

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
server-set cookie aborts cookie jar load
Source: CVE Program / CVE List V5
Vulnerability Description
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
curl curl 8.22.0 ~ 8.22.0 -

II. Public POCs for CVE-2026-92386

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92386

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92386 (1)

Other References for CVE-2026-92386 (1)

Other References for CVE-2026-92386 (1)

Same Patch Batch · curl · 2026-10-20 · 23 CVEs total

CVE-2026-92391 curl_mime_free stack overflow by recursion
CVE-2026-107928 info leak uploading over WebSockets with GnuTLS
CVE-2026-107929 local interface connection reuse mixup
CVE-2026-94266 password leak in CURLINFO_EFFECTIVE_URL
CVE-2026-94265 Authorization: Negotiate sent to foreign origin
CVE-2026-86415 auto client cert connection reuse mixup
CVE-2026-86414 leaking host credentials to HTTP proxy
CVE-2026-92390 -J no-clobber guarantee bypassed with 103 early hints
CVE-2026-92387 never-ending loop via server response omission
CVE-2026-92388 FTP wildcard write callback mixup
CVE-2026-92389 TFTP direction confusion
CVE-2026-86409 stale SigV4 headers sent unintended
CVE-2026-87865 knownhost callback mismatches key as missing
CVE-2026-87864 IMAP APPEND plus CRLF conversion command injection
CVE-2026-87863 HSTS response erases persisted entries
CVE-2026-87866 wolfSSL public-key pinning bypass
CVE-2026-87861 cross-origin reuse of a Negotiate connection
CVE-2026-87862 HSTS cache import drops longer-lived child
CVE-2026-86411 FTP connection reuse inherits client-certificate
CVE-2026-86412 server-set cookie erases cookie jar

Showing top 20 of 23 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: curl
Same vendor: curl