This vulnerability involves libcurl’s handling of server‑set cookies. A remote HTTP server can send a Set‑Cookie header that curl accepts and writes to its Netscape cookie jar. On the next invocation using the same path for `--cookie` and `--cookie-jar`, the client fails before connecting and its cleanup routine replaces the jar with an empty file, deleting cookies for unrelated domains. Because authentication tokens and session data are stored in cookies, the flaw can erase session information and disrupt application functionality. The issue is due to improper cookie management logic (CWE‑754).

The cURL client library (used by many applications on Windows, Linux, macOS) is affected. Any program that relies on libcurl's cookie handling is impacted. The specific vulnerable versions are not listed in the available data.

The base CVSS score is 8.1, indicating high severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The lack of an explicit attack‑vector annotation suggests that exploitation would require the attacker to influence server responses or communicate with the client over the network. The vulnerability is most likely relevant to remote or local attackers who can dictate headers to the cURL client. While it does not enable arbitrary code execution, it can disrupt application functionality by erasing cookies, potentially causing authentication failure and denial of service.