# CVE-2026-92386: curl server-set cookie aborts cookie jar load

Source: https://junglewise.ai/threats/cve-2026-92386-when-writing-a-long-cookie-name-and-value-to-a-netscape-cookie  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-92386 · Severity: info · Published 2026-10-20

curl is a widely-used command-line tool and library for transferring data over HTTP and other protocols. When a remote server sends a cookie with a very long name and value, curl writes it to the cookie jar file in a way that exceeds the tool's line-length parsing limit. This causes subsequent curl operations using that cookie jar to silently skip all cookies after the oversized entry, resulting in missing authentication or session data that could affect application functionality.

Technologies: [Curl](https://junglewise.ai/threats/technologies/curl-curl). Vendors: [Curl](https://junglewise.ai/threats/vendors/curl).

## Quick answers

**Is CVE-2026-92386 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92386 being exploited in the wild.

**How severe is CVE-2026-92386?** Informational severity, published 20 October 2026.

**Which products and versions are affected?** Curl 8.7.0 to 8.22.0; also affects 8.14.0–8.14.2, 8.15.0–8.16.1, 8.17.0–8.20.1.

**Is there a fix for CVE-2026-92386?** Yes: fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92386 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92386?** Check whether you run Curl at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in curl 8.23.0, 8.20.2 (8.20.x branch), 8.16.2 (8.16.x branch), 8.14.3 (8.14.x branch)

## Technical details

The vulnerability is an input validation flaw in curl's Netscape cookie jar writer. A remote HTTP server sends a cookie that, when written to the jar file, creates a line exceeding curl's parser limit. On subsequent reads with --cookie, the parser aborts prematurely upon encountering this line, silently skipping all remaining valid cookies in the file. The attack requires an HTTP response from a server under attacker control, and the impact depends on the cookie's position in the jar.

## Affected products

- curl curl 8.7.0 to 8.22.0; also affects 8.14.0–8.14.2, 8.15.0–8.16.1, 8.17.0–8.20.1

## Timeline

- 2026-09-11: disclosed
- 2026-10-14: advisory
- 2026-10-14: patched: curl 8.23.0 released

## References

- [https://curl.se/docs/CVE-2026-92386.html](https://curl.se/docs/CVE-2026-92386.html)
- [https://curl.se/docs/CVE-2026-92386.json](https://curl.se/docs/CVE-2026-92386.json)

## Related threats

- [libcurl credentials leak in CURLINFO_EFFECTIVE_URL](https://junglewise.ai/threats/cve-2026-94266-libcurl-could-accidentally-return-a-url-for-curl-easy-getinfo-s)
- [curl Negotiate authentication credential exposure on redirect](https://junglewise.ai/threats/cve-2026-94265-when-processing-an-http-redirect-to-a-url-containing-userinfo-a)
- [curl stack overflow in MIME structure cleanup](https://junglewise.ai/threats/cve-2026-92391-a-deeply-nested-multipart-mime-structure-constructed-via-the)
- [curl remote-header-name file overwrite bypass](https://junglewise.ai/threats/cve-2026-92390-when-invoked-with-remote-header-name-j-curl-fails-to-preserve-its)
- [curl infinite loop via server response omission](https://junglewise.ai/threats/cve-2026-92387-by-permanently-omitting-the-final-control-response-line-a)