CVE-2026-80255: secure cookie attribute bypass with tab
A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Affected Software
Event History
Frequently Asked Questions
What must an attacker control to exploit this issue?
An attacker needs to cause curl to process a Set-Cookie header that uses a horizontal tab immediately before the Secure attribute. The resulting cookie must later be used in a plaintext HTTP request to the same host for the exposure to occur.
Are cookies with a normally formatted Secure attribute affected?
The described behavior applies when a horizontal tab (ASCII 9), rather than a space (ASCII 32), appears immediately before the Secure attribute. The provided information does not indicate that normally space-formatted Secure attributes are affected.
How can I identify potentially affected cookies?
Inspect Set-Cookie headers processed by curl for a horizontal tab immediately before Secure. Also check whether cookies received from such headers were subsequently sent to the same host over plaintext HTTP.