CVE-2026-63481: Hurl: Cookies in Cookies section leak when redirecting to a different host
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Hurlto a version that resolves this vulnerability.Fixed in 8.1.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Hurl 8.0.1 and earlier are exposed when a request defines cookies through the dedicated [Cookies] section and follows a redirect to a different host. The redirect destination can receive cookies intended for the original host if it is attacker-controlled.
What cookie configurations are affected?
Only cookies represented by RequestSpec.cookies from Hurl's dedicated [Cookies] section are affected by this redirect path. Cookies supplied as a raw Cookie header are stripped on cross-host redirects and are not affected by this specific issue.
What should be done if Hurl scripts use cross-host redirects?
Upgrade to Hurl 8.1.0, which is reported as fixed. Until upgrading, avoid following redirects from requests that use the [Cookies] section when the redirect target could change hosts or be attacker-controlled.