When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length… (CVE-2026-92386)

When curl writes a long cookie name and value to a Netscape cookie jar, a remote HTTP server can cause curl to write a record that exceeds the line-length parsing limit. This malformed cookie record causes any subsequent curl command reading from the same cookie jar with the --cookie option to silently stop parsing at the long line, ignoring all valid cookies after it. This behavior can disrupt cookie handling in curl but does not include details on further exploitation or impact beyond cookie parsing interruption.

The vulnerability causes curl to silently abort parsing of cookie files when encountering an excessively long cookie record, leading to ignored valid cookies that follow. This can disrupt applications relying on curl's cookie handling, potentially affecting session management or authentication flows that depend on those cookies. There is no information about remote code execution or other severe impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious about cookie jars created by untrusted servers and consider manually inspecting or sanitizing cookie files to avoid lines exceeding parsing limits.