new file mode 100644
@@ -0,0 +1,33 @@
+From 445aa87e13f91c94bc742f54343a2eac924e1765 Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 16 Sep 2026 11:09:18 +0200
+Subject: [PATCH] cookie: accept slightly longer lines in cookie jars
+
+Closes #22964
+
+CVE: CVE-2026-92386
+Upstream-Status: Backport [https://github.com/curl/curl/commit/445aa87e13f91c94bc742f54343a2eac924e1765]
+
+(cherry picked from commit 445aa87e13f91c94bc742f54343a2eac924e1765)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cookie.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 8d9acf1..b88ff56 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -1115,7 +1115,9 @@ static CURLcode cookie_load(struct Curl_easy *data, const char *file,
+ if(fp) {
+ struct dynbuf buf;
+ bool eof = FALSE;
+- curlx_dyn_init(&buf, MAX_COOKIE_LINE);
++ /* accept a little longer lines so that a full cookie fits and does not
++ abort the file read */
++ curlx_dyn_init(&buf, MAX_COOKIE_LINE + 48);
+ do {
+ result = Curl_get_line(&buf, fp, &eof);
+ if(!result) {
+--
+2.35.6
new file mode 100644
@@ -0,0 +1,146 @@
+From 7d64440abba37e3d8039fe663d3edc84f582ce92 Mon Sep 17 00:00:00 2001
+From: Zheng Yu <dataisland@outlook.com>
+Date: Wed, 14 Oct 2026 18:13:59 -0700
+Subject: [PATCH] cookie: reload complete self-generated cookie jar rows
+
+Closes #23407
+
+CVE: CVE-2026-92386
+Upstream-Status: Backport [https://github.com/curl/curl/commit/7d64440abba37e3d8039fe663d3edc84f582ce92]
+
+Backport Changes:
+- Match the two spaces before URL in the deleted CURLOPT_COOKIEJAR
+ line in lib1902.c; upstream's deleted line uses one space.
+
+(cherry picked from commit 7d64440abba37e3d8039fe663d3edc84f582ce92)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cookie.c | 9 ++++++---
+ tests/data/test1902 | 5 ++++-
+ tests/libtest/lib1902.c | 39 ++++++++++++++++++++++++++++++++++-----
+ 3 files changed, 44 insertions(+), 9 deletions(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index b88ff56..de40297 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -37,6 +37,7 @@
+ #include "curl_memrchr.h"
+ #include "parsedate.h"
+ #include "curlx/strdup.h"
++#include "curlx/dynbuf.h"
+ #include "llist.h"
+ #include "curlx/strparse.h"
+
+@@ -1115,9 +1116,11 @@ static CURLcode cookie_load(struct Curl_easy *data, const char *file,
+ if(fp) {
+ struct dynbuf buf;
+ bool eof = FALSE;
+- /* accept a little longer lines so that a full cookie fits and does not
+- abort the file read */
+- curlx_dyn_init(&buf, MAX_COOKIE_LINE + 48);
++ /* get_netscape_format() uses curl_maprintf(), which returns at most
++ DYN_APRINTF - 1 bytes. cookie_output() adds a newline (CRLF on Windows),
++ and this dynbuf needs one more byte for its null-terminator. This is a
++ cap, not an allocation. */
++ curlx_dyn_init(&buf, DYN_APRINTF + 2);
+ do {
+ result = Curl_get_line(&buf, fp, &eof);
+ if(!result) {
+diff --git a/tests/data/test1902 b/tests/data/test1902
+index a794fd4..876384d 100644
+--- a/tests/data/test1902
++++ b/tests/data/test1902
+@@ -3,6 +3,7 @@
+ <info>
+ <keywords>
+ cookies
++cookiejar
+ </keywords>
+ </info>
+
+@@ -10,7 +11,7 @@ cookies
+ <client>
+
+ <name>
+-set COOKIEFILE and COOKIEJAR but make no transfer
++reload a long cookie jar line without a transfer
+ </name>
+ <features>
+ cookies
+@@ -27,6 +28,7 @@ lib%TESTNUMBER
+ # https://curl.se/docs/http-cookies.html
+ # This file was generated by libcurl! Edit at your own risk.
+
++example.com FALSE /%repeat[6000 x q]% FALSE 0 long value
+ example.com FALSE / FALSE 0 has_js 1
+ </file>
+ </client>
+@@ -38,6 +40,7 @@ example.com FALSE / FALSE 0 has_js 1
+ # https://curl.se/docs/http-cookies.html
+ # This file was generated by libcurl! Edit at your own risk.
+
++example.com FALSE /%repeat[6000 x q]% FALSE 0 long value
+ example.com FALSE / FALSE 0 has_js 1
+ </file>
+ </verify>
+diff --git a/tests/libtest/lib1902.c b/tests/libtest/lib1902.c
+index da3b23a..4af6249 100644
+--- a/tests/libtest/lib1902.c
++++ b/tests/libtest/lib1902.c
+@@ -27,19 +27,48 @@ static CURLcode test_lib1902(const char *URL)
+ {
+ CURLcode result = CURLE_OK;
+ CURL *curl;
++ struct curl_slist *cookies = NULL;
++ struct curl_slist *cookie;
++ bool long_found = FALSE;
++ bool short_found = FALSE;
++ size_t count = 0;
+
+ curl_global_init(CURL_GLOBAL_ALL);
+
+ curl = curl_easy_init();
+- if(curl) {
+- easy_setopt(curl, CURLOPT_COOKIEFILE, URL);
+- easy_setopt(curl, CURLOPT_COOKIEJAR, URL);
++ if(!curl) {
++ result = TEST_ERR_EASY_INIT;
++ goto test_cleanup;
++ }
++ easy_setopt(curl, CURLOPT_COOKIEFILE, URL);
++ easy_setopt(curl, CURLOPT_COOKIEJAR, URL);
++
++ /* The original case: no transfer means no cookie jar write. */
++ curl_easy_cleanup(curl);
++ curl = curl_easy_init();
++ if(!curl) {
++ result = TEST_ERR_EASY_INIT;
++ goto test_cleanup;
++ }
+
+- /* Do not perform any actual network operation,
+- the issue occur when not calling curl.*perform */
++ /* Explicitly reload the same jar, also without starting a transfer. */
++ easy_setopt(curl, CURLOPT_COOKIEFILE, URL);
++ easy_setopt(curl, CURLOPT_COOKIELIST, "RELOAD");
++ result = curl_easy_getinfo(curl, CURLINFO_COOKIELIST, &cookies);
++ if(result)
++ goto test_cleanup;
++ for(cookie = cookies; cookie; cookie = cookie->next) {
++ if(strstr(cookie->data, "\tlong\tvalue"))
++ long_found = strlen(cookie->data) > 5048;
++ if(strstr(cookie->data, "\thas_js\t1"))
++ short_found = TRUE;
++ count++;
+ }
++ if(count != 2 || !long_found || !short_found)
++ result = TEST_ERR_FAILURE;
+
+ test_cleanup:
++ curl_slist_free_all(cookies);
+ curl_easy_cleanup(curl);
+ curl_global_cleanup();
+ return result;
+--
+2.35.6
@@ -53,6 +53,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-87862.patch \
file://CVE-2026-92387.patch \
file://CVE-2026-86412.patch \
+ file://CVE-2026-92386_p1.patch \
+ file://CVE-2026-92386_p2.patch \
"
SRC_URI:append:class-nativesdk = " \