CVE-2026-80255

Published: Sep 6, 2026Modified: Sep 8, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Related CWEs

CWE-201

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (4)

https://curl.se/docs/CVE-2026-80255.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://curl.se/docs/CVE-2026-80255.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://hackerone.com/reports/3972395

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

https://hackerone.com/reports/3972395

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.