22 matches found
GHSA-7W2G-9MF9-324M Hurl: Cookies in Cookies section leak when redirecting to a different host
The Bug Hurl = 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the Header/headers area 2. In a dedicated Cookies section parsed into RequestSpec.cookies When following a redirect to a different host, Hurl correctly strips security-sensitive data Authorization...
EUVD-2026-63465
Hurl: Cookies in Cookies section leak when redirecting to a different host...
Hurl: Cookies in Cookies section leak when redirecting to a different host
The Bug Hurl = 8.0.1 lets you define cookies two ways in a .hurl file: 1. As a raw Cookie: header in the Header/headers area 2. In a dedicated Cookies section parsed into RequestSpec.cookies When following a redirect to a different host, Hurl correctly strips security-sensitive data Authorization...
SUSE CVE-2026-63481
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
Linux Distros Unpatched Vulnerability : CVE-2026-63481
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in...
DEBIAN-CVE-2026-63481
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
UBUNTU-CVE-2026-63481
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481
Hurl (a command-line tool for running and testing HTTP requests from plain-text files) is vulnerable to cookie leakage on cross-host redirects in versions 8.0.1 and earlier . The redirect handler in packages/hurl/src/http/client.rs correctly strips Authorization and Cookie headers when the redire...
CVE-2026-63481
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
CVE-2026-63481: Insertion of Sensitive Information Into Sent Data
Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries...
PT-2026-79063
Name of the Vulnerable Software and Affected Versions Hurl versions prior to 8.1.0 Description Redirect handling in the packages/hurl/src/http/client.rs file fails to properly scope cookies. While Authorization and Cookie headers and basic-auth credentials are stripped when a redirect changes hos...
GHSA-CQ8V-F236-94QC vulnerabilities
Vulnerabilities for packages: rustup, wizer, atuin, sqlx, parseable, yazi, py3-xet-core, ruff, starship, biome, linkerd2, zellij, zed, deno, qdrant, berg, xh, yara-x, sccache, mountpoint-s3, hurl, just, uv, lychee, buck2, shadowsocks-rust, vector, fish, sdp-k8s-injector, samply, wadm, kdash,...
GHSA-CQ8V-F236-94QC vulnerabilities
Vulnerabilities for packages: apollo-router, sqlx, hurl, just, vector, wasmcloud, ntpd-rs, linkerd-network-validator, fish, wasmtime, wizer, pgcat, xh, rav1e, jujutsu, efs-utils, asciinema, linkerd2-proxy, chaos-tproxy, fnm, komodo, mountpoint-s3, buck2, uutils, bootc, cargo-audit, ruff, virtiofs...
EUVD-2025-18116
Malicious code in bioql PyPI...
GHSA-V33J-V3X4-42QG Regex literal in Hurl files are not escaped when exported to HTML, allowing injections
Given this Hurl file: regex.hurl: GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // When exported to HTML: $ hurlfmt --out html regex.hurl GET https://foo.com HTTP 200 Asserts jsonpath "$.body" matches // The regex literal // is not escaped: // When opened in a browser, the code i...