A flaw in curl’s cookie handling allows a remote server to send an excessively long cookie name and value that exceeds curl’s internal line‑length limit when the cookies are written to a file. When curl subsequently reads that file, the oversized entry causes the parser to abort silently and drop all remaining valid entries, effectively erasing any usable cookie state and leading to a denial of service in affected curl sessions.

The vulnerability affects all releases of curl that have not yet been patched to limit cookie line length. No specific product versions are listed in the CNA data, so all older releases that match the description are considered impacted. Systems that rely on curl to maintain authentication via cookies, such as web clients or automated scripts, are at risk.

The CVSS score of 4.3 reflects a moderate severity. Because the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the public exploitation probability is uncertain but the attack vector is clear: a malicious server can trigger the defect simply by sending a cookie header with an oversized value. The impact is limited to a loss of cookie state, which can break authentication or session persistence but does not give the attacker code execution or elevated privileges.