CVE-2026-86412
Publication date 14 October 2026
Last updated 14 October 2026
Ubuntu priority
Description
A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for `--cookie` and `--cookie-jar`, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies for unrelated domains.
Why is this CVE low priority?
Upstream defined this as low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 26.04 LTS resolute |
Fixed 8.18.0-1ubuntu2.8
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
References
Related Ubuntu Security Notices (USN)
- USN-8927-1
- curl vulnerabilities
- 14 October 2026