GHSA-cfhr-3c9j-cfhwHighCVSS 8.1

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but...

Published
October 20, 2026
Last Modified
October 29, 2026

🔗 CVE IDs covered (1)

📋 Description

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.

🔗 References (5)