CVE-2026-80255

The curl utility incorrectly handles the Set-Cookie: header when a horizontal tab (ASCII code 9) is used instead of a space (ASCII code 32) before the Secure attribute. This parsing error causes curl to store the cookie without the Secure flag, potentially leading to the cookie being transmitted ...

CVE-2026-80255 secure cookie attribute bypass with tab

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

curl: curl: Information disclosure due to secure cookie attribute bypass

A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...