https://seclists.org/oss-sec/2026/q2/271: [ADVISORY] curl: CVE-2026-6276: stale custom cookie host causes cookie leak
Published Apr 29, 2026
·Updated
Affected Software
1 affected component
curl libcurl>=7.71.0<=8.19.0
Frequently Asked Questions
1
What is the severity of CVE-2026-6276?
CVE-2026-6276 has a medium severity rating due to the potential for cookie leakage.
2
How do I fix CVE-2026-6276?
To fix CVE-2026-6276, update your curl or libcurl version to the latest release that addresses this vulnerability.
3
What causes the vulnerability in CVE-2026-6276?
The vulnerability in CVE-2026-6276 is caused by stale custom `Host:` headers leading to unintentional cookie leakage.
4
Who is affected by CVE-2026-6276?
Developers and applications that utilize curl or libcurl with custom `Host:` headers are affected by CVE-2026-6276.
5
What types of applications use curl and are vulnerable to CVE-2026-6276?
Applications that rely on HTTP requests and use curl or libcurl with customized HTTP headers may be vulnerable to CVE-2026-6276.