CVE-2026-80255

Published: Sep 6, 2026Modified: Sep 15, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Affected (1)

Products: Haxx: Curl

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	8.13.0 ≤ version < 8.22.0

Related CWEs

Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

References (4)

https://curl.se/docs/CVE-2026-80255.html

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

PatchVendor Advisory

https://curl.se/docs/CVE-2026-80255.json

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

Vendor Advisory

https://hackerone.com/reports/3972395

Source: 2499f714-1537-4658-8207-48ae4bb9eae9

ExploitMitigationThird Party Advisory

https://hackerone.com/reports/3972395

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationThird Party Advisory

Timeline

No history available yet.