Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure client to malicious server
-
ExploitServer sends crafted Set-Cookie header
-
Executioncurl aborts cookie jar load
-
ImpactPersisted cookies dropped for session
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires that the curl/libcurl client is configured to use a persistent cookie jar (e.g. the -b/--cookie or -c/--cookie-jar options, or CURLOPT_COOKIEFILE/CURLOPT_COOKIEJAR in libcurl) and that the victim connects to an attacker-controlled or compromised server able to send a crafted Set-Cookie response. Limiting factors: the attacker must control the server side of the connection, the cookie jar feature must be in use (not curl's default when no cookie file is specified), and the impact is limited to curl aborting its cookie jar load rather than any memory corruption or credential disclosure. Affected versions are curl 8.7.0 through 8.22.0; 8.23.0 and later are not affected. |
| Impact | This is a LOW-severity curl/libcurl vulnerability and the available signals reinforce that low priority. No CVSS score or vector was published in the input (CVSS Score: N/A), no EPSS exploitation probability is provided, the issue is NOT listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The curl project itself rated it LOW (one of 23 LOW issues bundled with a single HIGH, CVE-2026-92392, in the 8.23.0 release). The real-world impact is an integrity/availability problem confined to curl's own cookie handling: a server-set cookie can abort the loading of the cookie jar, meaning previously persisted cookies may fail to load. This does not yield code execution, data disclosure to the attacker, or privilege gain. Because no numeric CVSS or EPSS is supplied, severity rests on the vendor's own LOW rating rather than independent scoring - this is explicitly a vendor-rated-low issue, not a high-CVSS-but-low-real-risk discrepancy. The main caveat: curl's near-ubiquitous deployment means even a minor bug has an enormous installed base, but the low technical impact keeps actual risk modest. |
| Exploit ScenarioDerived | A victim runs curl (or an application using libcurl) with a persistent cookie jar file and connects to a malicious or compromised HTTP server. The server returns a crafted Set-Cookie response that causes curl to abort loading its saved cookie jar, so the client silently proceeds without its stored cookies. No public exploit code is identified; this is a logic/parsing flaw rather than a memory-corruption bug. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
A crafted Set-Cookie header returned by a server can abort the loading of curl/libcurl's cookie jar in versions 8.7.0 through 8.22.0, disrupting the client's cookie-persistence routine instead of completing the jar load. The flaw is only reachable when the client is configured to use a persistent cookie jar (the -b/--cookie or -c/--cookie-jar options, or CURLOPT_COOKIEFILE/CURLOPT_COOKIEJAR in libcurl) and the attacker controls or has compromised the server end of the connection, so it is a network-reachable but low-impact integrity issue (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The curl project rates this LOW severity as part of its 8.23.0 release, no public exploit code or confirmed active exploitation has been identified at time of analysis, and no EPSS or KEV signal is associated with the CVE.
RemediationAI
Upgrade to curl/libcurl 8.23.0 or later, which is the vendor-released fixed version per the curl 8.23.0 security release and the vulnerability table at https://curl.se/docs/security.html; downstream embedders should pull the corresponding libcurl build for their platform. Because the issue is only triggerable when a persistent cookie jar is configured, an interim mitigation is to avoid combining -b/--cookie or -c/--cookie-jar (or CURLOPT_COOKIEFILE/CURLOPT_COOKIEJAR) with connections to servers that are untrusted or potentially attacker-controlled - the trade-off is loss of cookie persistence across requests, which can break session continuity in legitimate workflows. Running curl without any cookie-jar option leaves the engine unloaded and therefore not exposed, at the cost of not persisting or importing cookies at all. There is no identified memory-safety or credential-disclosure impact to mitigate, and no KEV or exploit signal warrants emergency compensating controls; treat this as a routine patch-cycle item bundled with the other twenty-three advisories in the same release. The oss-security advisory at https://seclists.org/oss-sec/2026/q4/154 and the vendor advisory at https://curl.se/docs/security.html list the associated fix commits for tracking integration into distributions.
Affected ProductsAI
Affected is curl and libcurl from version 8.7.0 through 8.22.0 inclusive, as recorded in the curl vulnerability table published on 2026-10-14 (first affected 8.7.0, last affected 8.22.0); the fix ships in curl 8.23.0. The flaw spans the shared HTTP cookie engine and therefore applies equally to the curl command-line tool and to applications statically or dynamically linking libcurl that enable CURLOPT_COOKIEFILE/CURLOPT_COOKIEJAR. Official details and the per-version vulnerability matrix are available at https://curl.se/docs/security.html, with the release announcement distributed on the oss-security list (https://seclists.org/oss-sec/2026/q4/154) and commercial LTS support information at https://rock-solid.curl.dev. No separate CPE strings were provided in the source data; the curl advisory page is the authoritative affected-version reference.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
curl and its embedded library libcurl implement an internal 'cookie engine' that can import cookies from a file at start-up and persist cookies back to that jar file at shutdown. When a server response includes a Set-Cookie header while a persistent jar is in use, the interaction between the incoming cookies and the on-disk jar state is mishandled: rather than merging or skipping the offending cookie, curl aborts the jar load. No CWE identifier or NVD-assigned CVSS vector was supplied with this record, so the root-cause class is not formally classified in the available data; functionally the defect is a cookie-state handling failure that yields a denial of the cookie-persistence routine rather than memory corruption or credential exposure. The affected code path is the HTTP cookie parsing/serialization logic shared by libcurl and the curl tool, which explains why both library embedders and command-line users are affected. Because the trigger is entirely server-controlled and the victim only needs an active cookie jar, the practical exposure is limited to clients that deliberately enable persistent cookies when talking to untrusted or attacker-influenced endpoints.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
A remote server triggers the flaw over the network with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); impact is limited to disrupting the client's cookie jar load, a low integrity effect with no confidentiality or availability loss.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB