CVE-2026-80255 - Vulnerability Details - OpenCVE

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Vendors	Products
Curl	Curl

No data.

No data.

References

Link	Providers
https://curl.se/docs/CVE-2026-80255.html
https://curl.se/docs/CVE-2026-80255.json
https://hackerone.com/reports/3972395

History

Thu, 10 Sep 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-1024

Tue, 08 Sep 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-201
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 06 Sep 2026 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Curl Curl curl
Vendors & Products		Curl Curl curl

Sun, 06 Sep 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-1024

Sun, 06 Sep 2026 18:00:00 +0000

Type	Values Removed	Values Added
Description		A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Title		secure cookie attribute bypass with tab
References		https://curl.se/docs/CVE-2026-80255.html https://curl.se/docs/CVE-2026-80255.json https://hackerone.com/reports/3972395

MITRE

Status: PUBLISHED

Assigner: curl

Published: 2026-09-06T17:48:54.275Z

Updated: 2026-09-08T18:45:49.180Z

Reserved: 2026-08-26T06:25:58.220Z

Link: CVE-2026-80255

Vulnrichment

Updated: 2026-09-08T18:45:43.369Z

NVD

Status : Undergoing Analysis

Published: 2026-09-06T18:17:22.623

Modified: 2026-09-08T19:19:54.520

Link: CVE-2026-80255

Redhat

No data.

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-80255", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T18:45:09.883106Z"}}}], "references": [{"url": "https://hackerone.com/reports/3972395", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201 Insertion of Sensitive Information Into Sent Data"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T18:45:43.369Z"}}], "cna": {"title": "secure cookie attribute bypass with tab", "credits": [{"lang": "en", "type": "finder", "value": "Stanislav Fort (Aisle Research)"}, {"lang": "en", "type": "remediation developer", "value": "Daniel Stenberg"}], "affected": [{"vendor": "curl", "product": "curl", "versions": [{"status": "affected", "version": "8.21.0", "versionType": "semver", "lessThanOrEqual": "8.21.0"}, {"status": "affected", "version": "8.20.0", "versionType": "semver", "lessThanOrEqual": "8.20.0"}, {"status": "affected", "version": "8.19.0", "versionType": "semver", "lessThanOrEqual": "8.19.0"}, {"status": "affected", "version": "8.18.0", "versionType": "semver", "lessThanOrEqual": "8.18.0"}, {"status": "affected", "version": "8.17.0", "versionType": "semver", "lessThanOrEqual": "8.17.0"}, {"status": "affected", "version": "8.16.0", "versionType": "semver", "lessThanOrEqual": "8.16.0"}, {"status": "affected", "version": "8.15.0", "versionType": "semver", "lessThanOrEqual": "8.15.0"}, {"status": "affected", "version": "8.14.1", "versionType": "semver", "lessThanOrEqual": "8.14.1"}, {"status": "affected", "version": "8.14.0", "versionType": "semver", "lessThanOrEqual": "8.14.0"}, {"status": "affected", "version": "8.13.0", "versionType": "semver", "lessThanOrEqual": "8.13.0"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://curl.se/docs/CVE-2026-80255.json", "name": "json"}, {"url": "https://curl.se/docs/CVE-2026-80255.html", "name": "www"}, {"url": "https://hackerone.com/reports/3972395", "name": "issue"}], "descriptions": [{"lang": "en", "value": "A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of\nspace (ascii code 32) immediately before the `Secure` attribute causes curl to\nstore the cookie without its Secure flag. The cookie might then wrongfully be\nsent over plaintext HTTP on subsequent requests to the same host."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-201 Information Exposure Through Sent Data"}]}], "providerMetadata": {"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "shortName": "curl", "dateUpdated": "2026-09-06T17:48:54.275Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80255", "state": "PUBLISHED", "dateUpdated": "2026-09-08T18:45:49.180Z", "dateReserved": "2026-08-26T06:25:58.220Z", "assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9", "datePublished": "2026-09-06T17:48:54.275Z", "assignerShortName": "curl"}, "dataVersion": "5.2"}