CVE-2026-86412
NONE—CVSS v3
—CVSS v2
0.29%
EPSS (exploit probability)
—CWE
Description
A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape cookie jar but cannot reload. On the next invocation using the same
path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the
cleanup procedure replaces the jar with an empty file, deleting cookies for
unrelated domains.
Affected routers (0)
No routers currently mapped to this CVE in our database.