A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. (CVE-2026-86412)

This vulnerability (CVE-2026-86412) involves curl's handling of cookies. A remote HTTP server can set a cookie that curl accepts and writes to a Netscape-format cookie jar file. However, when curl attempts to reload this cookie jar on the next invocation using the same path for --cookie and --cookie-jar options, it fails before establishing a connection. During cleanup, curl replaces the cookie jar file with an empty file, resulting in deletion of cookies for unrelated domains stored in the same jar.

The impact is loss of cookies stored in the Netscape cookie jar file for unrelated domains, which can disrupt user sessions or automated processes relying on those cookies. There is no indication of remote code execution or data leakage. The failure occurs locally on the client side during curl's cookie jar reload process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid sharing cookie jar files across multiple domains or avoid using the same file for both --cookie and --cookie-jar options with untrusted servers. Monitoring vendor updates for an official fix is recommended.