CVE-2026-63481: Hurl: Cookies in Cookies section leak when redirecting to a different host

Published Aug 20, 2026
·
Updated

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.

Affected Software

1 affected component
Hurl Hurl<=8.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Hurl to a version that resolves this vulnerability.

    Fixed in 8.1.0

Event History

Aug 20, 2026
CVE Published
via MITRE·04:28 PM
Data Sourced
via MITRE·04:28 PM
DescriptionWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Users of Hurl 8.0.1 and earlier are exposed when a request defines cookies through the dedicated [Cookies] section and follows a redirect to a different host. The redirect destination can receive cookies intended for the original host if it is attacker-controlled.

2

What cookie configurations are affected?

Only cookies represented by RequestSpec.cookies from Hurl's dedicated [Cookies] section are affected by this redirect path. Cookies supplied as a raw Cookie header are stripped on cross-host redirects and are not affected by this specific issue.

3

What should be done if Hurl scripts use cross-host redirects?

Upgrade to Hurl 8.1.0, which is reported as fixed. Until upgrading, avoid following redirects from requests that use the [Cookies] section when the redirect target could change hosts or be attacker-controlled.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203