The vulnerability involves the cURL library handling server‑set cookies incorrectly; a Set‑Cookie header can cause the client to clear its entire cookie jar, potentially discarding authentication tokens and session data. This flaw arises from improper cookie management logic (CWE‑754). An attacker that can influence server responses could trigger cookie erasure, leading to loss of user session continuity and denial of service for authenticated operations.

The cURL client library (used by many applications on Windows, Linux, macOS) is affected. Any program that relies on libcurl's cookie handling is impacted. The specific vulnerable versions are not listed in the available data.

The base CVSS score is 5.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The lack of an explicit attack‑vector annotation suggests that exploitation would require the attacker to influence server responses or communicate with the client over the network. The vulnerability is most likely relevant to remote or local attackers who can dictate headers to the cURL client. While it does not enable arbitrary code execution, it can disrupt application functionality by erasing cookies, potentially causing authentication failure and denial of service.