curl/libcurl CVE-2026-86412

Requires the libcurl-based application to have the cookie engine enabled with cookie-jar file persistence (command-line -c/--cookie-jar or CURLOPT_COOKIEJAR), and the victim must connect to a server the attacker controls, has compromised, or can impersonate via MITM. Affected only in curl/libcurl 8.18.0 through 8.22.0 (fixed in 8.23.0). Limiting factors: if cookie-jar persistence is not used the flaw is not reachable; there is no authentication or special network position beyond serving a response to the client; and the impact is bounded to erasure/loss of stored cookie data, with no code execution, no credential disclosure, and no compromise of other system state.

This is a genuinely LOW-priority issue and the available signals are consistent on that point, though most quantitative signals are simply absent. The curl project itself rates CVE-2026-86412 as severity LOW, and no CVSS vector, CWE, EPSS score, KEV listing, or POC was provided in the input - so there is no evidence of active exploitation or even public exploit code (no public exploit identified at time of analysis). The flaw's nature - a server-set cookie causing the cookie jar to be erased - is a data-integrity/data-loss bug affecting only locally persisted cookie state, not memory corruption, code execution, or credential disclosure, which is why it sits at the bottom of curl's 24-CVE batch (the only HIGH in the same release is CVE-2026-92392, an HTTP/2 use-after-free). The one amplifying factor is prevalence: curl/libcurl is ubiquitous (>20 billion installations), so even a low-impact bug has enormous reach. However, reach is not risk here - exploitation requires the victim client to both use cookie-jar persistence and connect to an attacker-influenced server, and the worst outcome is loss of stored cookies. No signals conflict, but note the key limitation explicitly: with no CVSS vector supplied, authentication and attack-vector characteristics are inferred from the description rather than confirmed. Patch by upgrading to curl 8.23.0.

An application built on libcurl with cookie-jar persistence enabled (e.g. -c/--cookie-jar or CURLOPT_COOKIEJAR) connects to a malicious or compromised HTTP server. The server returns a specially crafted Set-Cookie response that causes libcurl to erase the existing persisted cookie jar, destroying previously stored cookies and forcing session/state loss on the client. No public exploit code was identified at time of analysis, and the impact is limited to cookie data loss rather than code execution or disclosure.