CVE-2026-80255 PUBLISHED

secure cookie attribute bypass with tab

Assigner: curl
Reserved: 26.08.2026 Published: 06.09.2026 Updated: 06.09.2026

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Product Status

Vendor curl
Product curl
Versions Default: unaffected
  • affected from 8.21.0 to 8.21.0 (incl.)
  • affected from 8.20.0 to 8.20.0 (incl.)
  • affected from 8.19.0 to 8.19.0 (incl.)
  • affected from 8.18.0 to 8.18.0 (incl.)
  • affected from 8.17.0 to 8.17.0 (incl.)
  • affected from 8.16.0 to 8.16.0 (incl.)
  • affected from 8.15.0 to 8.15.0 (incl.)
  • affected from 8.14.1 to 8.14.1 (incl.)
  • affected from 8.14.0 to 8.14.0 (incl.)
  • affected from 8.13.0 to 8.13.0 (incl.)

Credits

  • Stanislav Fort (Aisle Research) finder
  • Daniel Stenberg remediation developer

References

Problem Types

  • CWE-201 Information Exposure Through Sent Data