CVE-2026-86412 – A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie ja

A remote HTTP server can set a cookie that curl accepts and writes to a
Netscape cookie jar but cannot reload. On the next invocation using the same
path for `–cookie` and `–cookie-jar`, curl fails before connecting, then the
cleanup procedure replaces the jar with an empty file, deleting cookies for
unrelated domains.