EUVD-2026-63465

Hurl: Cookies in Cookies section leak when redirecting to a different host...

Linux Distros Unpatched Vulnerability : CVE-2026-63481

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in...

CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

DEBIAN-CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

UBUNTU-CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481

Hurl (a command-line tool for running and testing HTTP requests from plain-text files) is vulnerable to cookie leakage on cross-host redirects in versions 8.0.1 and earlier . The redirect handler in packages/hurl/src/http/client.rs correctly strips Authorization and Cookie headers when the redire...

CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

CVE-2026-63481

Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...

PT-2026-79063

Name of the Vulnerable Software and Affected Versions Hurl versions prior to 8.1.0 Description Redirect handling in the packages/hurl/src/http/client.rs file fails to properly scope cookies. While Authorization and Cookie headers and basic-auth credentials are stripped when a redirect changes hos...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: just, ruff, deno, buck2, zola, cargo-c, samply, wizer, yazi, zellij, pixi, sccache, ntpd-rs, py3-xet-core, nushell, shadowsocks-rust, zed, linkerd2-proxy, pgcat, efs-utils, linkerd2, atuin, fish, hurl, qdrant, mountpoint-s3, wasmcloud, mdbook, wadm, uutils,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: linkerd2, lychee, wadm, wasmcloud, kdash, zellij, buck2, apollo-router, sqlx, starship, valkey-ldap, sentry-cli, fnm, cargo-audit, komodo, efs-utils, bootc, nushell, pgcat, mdbook, shadowsocks-rust, uv, watchexec, wasmtime, parseable, wizer, uutils, hurl, deno,...

EUVD-2025-18116

Malicious code in bioql PyPI...

GHSA-V33J-V3X4-42QG Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...

Regex literal in Hurl files are not escaped when exported to HTML, allowing injections

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...

PT-2025-26514 · Crates.Io · Hurl

Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...