CURL-CVE-2026-80255: secure cookie attribute bypass with tab

Published Sep 6, 2026

Updated

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Affected Software

1 affected component

curl curl

Event History

Sep 6, 2026

CVE Published

via OSV·05:48 PM

Data Sourced

via OSV·05:48 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to cause curl to process a Set-Cookie header in which a horizontal tab immediately precedes the Secure attribute. Curl then stores the cookie without the Secure flag, allowing it to be sent in a later plaintext HTTP request to the same host.

What is the practical impact of a successful exploit?

A cookie intended to be restricted to HTTPS can be transmitted over HTTP. This may expose the cookie to interception on the plaintext connection.

CURL-CVE-2026-80255: secure cookie attribute bypass with tab

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact of a successful exploit?