curl - secure cookie attribute bypass with tab

curl / Docs / curl CVEs / secure cookie attribute bypass with tab

CVE-2026-80255

Project curl Security Advisory, September 2 2026 Permalink

VULNERABILITY

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

INFO

This bug is not considered a C mistake (likely to have been avoided had we not been using C).

This flaw also affects the curl command line tool.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2026-80255 to this issue.

CWE-201: Information Exposure Through Sent Data

Severity: Low

AFFECTED VERSIONS

Affected versions: curl 8.13.0 to and including 8.21.0
Not affected versions: curl < 7.13.0 and >= 8.22.0
Introduced-in: https://github.com/curl/curl/1aea05a6c2699e80c75936d5

SOLUTION

Fixed-in: https://github.com/curl/curl/commit/4f6aa41a0145e930e76677

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 8.22.0

B - Apply the patch to your version and rebuild

C - Avoid using clear text HTTP transfers with cookies

TIMELINE

This issue was reported to the curl project on August 26, 2026.

curl 8.22.0 was released on September 2 2026, coordinated with the publication of this advisory.

CREDITS

Reported-by: Stanislav Fort (Aisle Research)
Patched-by: Daniel Stenberg

Thanks a lot!