CVE-2026-80255

curl (versions 8.13.0 through at least 8.21.0) contains a Secure cookie attribute bypass in its cookie parser. A Set-Cookie header using a horizontal tab (ASCII 9) instead of a space before the Secure attribute causes curl to silently drop the Secure flag , storing the cookie as non-secure. On su...

CVE-2026-80255 secure cookie attribute bypass with tab

A Set-Cookie: header using tab horizontal tab, ASCII code 9 instead of space ascii code 32 immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host...

curl: curl: Information disclosure due to secure cookie attribute bypass

A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the sam...