Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- A long cookie set by a server can be written to a Netscape cookie jar. A later curl invocation using --cookie on that file can silently stop at the oversized line.
- Valid cookies after that line are ignored. The server cannot know or control the cookie's relative position, so many, few or no other cookies may be affected.
- The general affected range is 8.7.0 through 8.22.0. Exceptions start at 8.20.2 within 8.20.X, 8.16.2 within 8.16.X and 8.14.3 within 8.14.X; compare only within each branch.
- The project's options are upgrading to 8.23.0, applying the patch or not using cookies. Check separate curl and libcurl copies in tools, applications and containers.
Why can a saved cookie be missing from the next request?
CVE-2026-92386 concerns the file passed between two operations. A remote HTTP server can set a long cookie name and value that curl writes to a Netscape cookie jar, producing a record beyond curl's line-length parsing limit.
When a later curl invocation reads that same file through --cookie, it silently ends parsing at the oversized record and ignores valid cookies that follow. The file existing, a successful write and a complete subsequent read are separate things to establish.
curl rates the issue Low. The server cannot know or affect the cookie's relative position in the jar. The flaw may therefore affect many, few or no other cookies; it does not mean every run loses the entire jar.
Check the running version and its maintenance branch
The advisory's general affected range is curl 8.7.0 through 8.22.0, inclusive. Versions before 8.7.0 and from 8.23.0 are unaffected by this issue. The command-line tool is affected, and the advisory notes that applications may use libcurl without making that dependency obvious.
Three maintenance branches have additional exceptions: 8.20.2 and later within 8.20.X, 8.16.2 and later within 8.16.X, and 8.14.3 and later within 8.14.X. Each threshold applies only to its own branch. It is not a statement that every version numbered above 8.14.3 is fixed.
Record the tool or library the job actually uses, its version, package revision and installation source before matching those ranges. A distributor may backport a fix while retaining an older upstream version number; establish that through its advisory and package record, rather than the version of a different curl installed on the host.
Trace both the write and the later read
First, in an environment you are authorized to inspect, establish whether the job uses a Netscape cookie jar and which operations write and read it. This issue involves a later load of the same file. A failed login alone does not identify this flaw.
Next, check whether the reading job loads the file with --cookie, whether the path is the intended one, and which curl or libcurl version each side uses. Updating the interactive terminal's tool does not establish that a container job or embedded library was updated too.
If file or log inspection is needed, compare records and read results in a controlled local copy. Cookies can carry session data; keep the original jar, complete request headers and login details out of public troubleshooting tools. You do not need to create a malicious cookie to check whether a version falls within the affected range.
Choose the released fix or assess operating without cookies
The fix has been released. The official advisory states that curl 8.23.0 was released on October 14, 2026, alongside disclosure. It lists three options: upgrade to 8.23.0, apply the linked patch to the local version, or do not use cookies.
Where a supported package update exists, use the installation provider's update path for the affected copy. For a backport, check the patch record for this specific CVE. Fixing another HTTP/2, proxy-authentication or interface-selection issue does not establish that this one is addressed.
Not using cookies is a listed alternative, but a login or session workflow that depends on them may no longer work. Assess that requirement before pausing or adapting the job. The advisory does not present deleting the jar, clearing the session or repeatedly retrying as a reliable fix.
Confirm the original job can write and read correctly
In a controlled environment, check the updated copy and its package record, then review the original cookie write, subsequent load and application result. A patched version and a currently valid session are separate questions. Completing an upgrade alone does not establish that every login problem has recovered.
Consider an unexecuted example: a scheduled job saves cookies, and its next run loads them. If valid records near the beginning work while later valid records are ignored, file parsing deserves attention. Version, format and actual job evidence are still needed; the symptom does not prove exploitation.
This answer addresses a cookie-jar load ending early. For HTTP/2 uploads, HTTP proxy credentials and interface reuse in the same release, use the existing 8.23.0 guide in Sources and assess those vulnerabilities separately.
Sources
Frequently Asked Questions
How can 8.20.2 be unaffected when it is below 8.23.0?
This advisory explicitly excludes 8.20.2 and later within 8.20.X. It also excludes 8.16.2 and later within 8.16.X, and 8.14.3 and later within 8.14.X. Do not extend those thresholds across branches or treat them as proof that every other vulnerability is fixed.
Can I rule it out if cookies near the start of the file still work?
No. This mechanism stops parsing at an oversized record and ignores later valid cookies. The server cannot control that record's relative position. Partial success does not prove this flaw either; check the actual version, file format and load path.
Does a fresh cookie jar mean the problem is fixed?
A successful load of a new file establishes that observed result, not that affected software was patched. The project's options remain upgrading, applying the patch or avoiding cookies. Do not treat deleting the old jar or signing in again as a lasting fix, or send session files to a third party for validation.