JLSEC-2026-392

See a problem?
Please try reporting it to the source first.
Source
https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-392.md
Import Source
https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-392.json
JSON Data
https://api.test.osv.dev/v1/vulns/JLSEC-2026-392
Upstream
Published
2026-05-04T13:12:06.605Z
Modified
2026-05-04T13:15:37.562818Z
Summary
[none]
Details

A malicious server can serve excessive amounts of Set-Cookie: headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookies make subsequent HTTP requests to this, or other servers to which the cookies match, create requests that become larger than the threshold that curl uses internally to avoid sending crazy large requests (1048576 bytes) and instead returns an error.This denial state might remain for as long as the same cookies are kept, match and haven't expired. Due to cookie matching rules, a server on foo.example.com can set cookies that also would match for bar.example.com, making it it possible for a "sister server" to effectively cause a denial of service for a sibling site on the same second level domain using this method.

Database specific 
{
    "sources": [
        {
            "database_specific": {
                "status": "Modified"
            },
            "id": "CVE-2022-32205",
            "imported": "2026-05-02T08:39:45.491Z",
            "published": "2022-07-07T13:15:08.277Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2022-32205",
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32205",
            "modified": "2025-05-05T17:18:12.680Z"
        }
    ],
    "license": "CC-BY-4.0"
}
References

Affected packages

Julia / CURL_jll

Package

Name
CURL_jll
Purl
pkg:julia/CURL_jll?uuid=b21e61f3-bafc-59ac-ab14-4c5c62d6588d

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
8.5.0+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-392.json"

Julia / LibCURL_jll

Package

Name
LibCURL_jll
Purl
pkg:julia/LibCURL_jll?uuid=deac9b47-8bc7-5906-a0fe-35ac56dc84c0

Affected ranges

Type
SEMVER
Events
Introduced
7.71.1+0
Fixed
7.84.0+0

Database specific

source 
"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-392.json"