When a remote server sends a cookie with a name or value that is too large, curl writes it to a Netscape cookie jar exceeding its internal line‑length limit. Then, on the next curl invocation reading that jar with the --cookie option, the parser aborts at the oversized line and silently discards all remaining valid cookie entries, which removes usable cookie state and can cause a denial of service.

The vulnerability affects all releases of curl that have not yet been patched to limit cookie line length. No specific product versions are listed in the CNA data, so all older releases that match the description are considered impacted. Systems that rely on curl to maintain authentication via cookies, such as web clients or automated scripts, are at risk.

The CVSS score of 8.1 reflects a high severity. Because the EPSS score is very low (<1%) and the vulnerability is not listed in CISA's KEV catalog, the public exploitation probability is uncertain but the attack vector is clear: a malicious server can trigger the defect simply by sending a cookie header with an oversized value. The impact is limited to a loss of cookie state, which can break authentication or session persistence but does not give the attacker code execution or elevated privileges.