Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
MySQL 8.0.46-2 cookie file can cause curl to skip cookies
published 15 days ago
Summary
If a web server sends a very long cookie name or value, curl may write a line that exceeds its own limit in the Netscape‑style cookie file used by MySQL. When curl later reads that file, it stops processing at the long line and ignores any remaining valid cookies, which can break web sessions or automated scripts. Upgrade curl to a version that checks line length, or avoid using the affected cookie jar and limit cookie sizes.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | mysql | <= 8.0.46-2 |
Original advisory text
CVE-2026-92386 affecting package mysql 8.0.46-2
When writing a long cookie name and value to a Netscape cookie jar, a remote
HTTP server can make `curl` write a record that exceeds its line-length
parsing limit. Consequently, any subsequent `curl` invocation reading from
that same cookie jar using `--cookie` silently aborts parsing prematurely upon
encountering the too long line, ignoring all subsequent valid cookies in the
file.
HTTP server can make `curl` write a record that exceeds its line-length
parsing limit. Consequently, any subsequent `curl` invocation reading from
that same cookie jar using `--cookie` silently aborts parsing prematurely upon
encountering the too long line, ignoring all subsequent valid cookies in the
file.
References
Timeline
Published20 Oct 2026
Updated23 Oct 2026
First seen23 Oct 2026
Sources
AZL-110016 · OSV
Track software like this
Free during beta