CVE-2026-92386
Publication date 14 October 2026
Last updated 30 October 2026
Ubuntu priority
Description
When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record that exceeds its line-length parsing limit. Consequently, any subsequent `curl` invocation reading from that same cookie jar using `--cookie` silently aborts parsing prematurely upon encountering the too long line, ignoring all subsequent valid cookies in the file.
Read the notes from the security team
Why is this CVE low priority?
Upstream defined this as low severity
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| curl | 26.10 stonking |
Fixed in 8.20.0-2ubuntu11.1
|
| 26.04 LTS resolute |
Fixed in 8.18.0-1ubuntu2.8
|
|
| 24.04 LTS noble |
Not affected
|
|
| 22.04 LTS jammy |
Not affected
|
|
| 20.04 LTS focal |
Not affected
|
|
| 18.04 LTS bionic |
Not affected
|
|
| 16.04 LTS xenial |
Not affected
|
|
| 14.04 LTS trusty |
Not affected
|
Notes
charlescochran
This is fixed by the same upstream commit as CVE-2026-86412 (see CVE-2026-86412-post1.patch).
Severity score breakdown
CVSS version: CVSS v3.0
Base score
8.1 · High
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-8927-1
- curl vulnerabilities
- 14 October 2026
- USN-8927-2
- curl vulnerabilities
- 19 October 2026