Is CVE-2026-92386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-92386 being exploited in the wild.

How severe is CVE-2026-92386?

Informational severity, published 20 October 2026.

Which products and versions are affected?

Curl 8.7.0 to 8.22.0; also affects 8.14.0–8.14.2, 8.15.0–8.16.1, 8.17.0–8.20.1.

Is there a fix for CVE-2026-92386?

Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-92386 attacked?

It is attacked over the network.

Am I affected by CVE-2026-92386?

Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-92386: curl server-set cookie aborts cookie jar load

CVE-2026-92386 · Severity: info · Published 2026-10-20

curl is a widely-used command-line tool and library for transferring data over HTTP and other protocols. When a remote server sends a cookie with a very long name and value, curl writes it to the cookie jar file in a way that exceeds the tool's line-length parsing limit. This causes subsequent curl operations using that cookie jar to silently skip all cookies after the oversized entry, resulting in missing authentication or session data that could affect application functionality.

Technologies: Curl. Vendors: Curl.

Quick answers

Is CVE-2026-92386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-92386 being exploited in the wild.
How severe is CVE-2026-92386?: Informational severity, published 20 October 2026.
Which products and versions are affected?: Curl 8.7.0 to 8.22.0; also affects 8.14.0–8.14.2, 8.15.0–8.16.1, 8.17.0–8.20.1.
Is there a fix for CVE-2026-92386?: Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92386 attacked?: It is attacked over the network.
Am I affected by CVE-2026-92386?: Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

Technical details

The vulnerability is an input validation flaw in curl's Netscape cookie jar writer. A remote HTTP server sends a cookie that, when written to the jar file, creates a line exceeding curl's parser limit. On subsequent reads with --cookie, the parser aborts prematurely upon encountering this line, silently skipping all remaining valid cookies in the file. The attack requires an HTTP response from a server under attacker control, and the impact depends on the cookie's position in the jar.

Affected products

curl curl 8.7.0 to 8.22.0; also affects 8.14.0–8.14.2, 8.15.0–8.16.1, 8.17.0–8.20.1

Timeline

2026-09-11: disclosed
2026-10-14: advisory
2026-10-14: patched: curl 8.23.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.