Insertion of Sensitive Information Into Sent Data in cURL - CVE-2026-80255
Published: September 2, 2026
Vulnerability identifier: #VU146679
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-80255
CWE-ID: CWE-201
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper cookie attribute handling in the Set-Cookie header processing logic when parsing a Set-Cookie header that uses a tab immediately before the Secure attribute. A remote attacker can send a specially crafted Set-Cookie header to disclose sensitive information.
The issue can cause a cookie to be stored without its Secure flag and then be sent over plaintext HTTP on subsequent requests to the same host.
Affected software
cURL
Ubuntu
Fedora
curl
curl (Ubuntu package)
Ubuntu
Fedora
curl
curl (Ubuntu package)
How to mitigate CVE-2026-80255
Install security update from vendor's website.
cURL - update to 8.22.0
curl - addressed in versions 8.15.0-11.fc43, 8.15.0-12.fc43, 8.18.0-12.fc44, 8.21.0-7.fc45
curl (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.19+esm20, 7.58.0-2ubuntu3.24+esm14, 7.68.0-1ubuntu2.25+esm9, 7.81.0-1ubuntu1.29, 8.5.0-2ubuntu10.15, 8.18.0-1ubuntu2.7
curl - addressed in versions 8.15.0-11.fc43, 8.15.0-12.fc43, 8.18.0-12.fc44, 8.21.0-7.fc45
curl (Ubuntu package) - addressed in versions 7.47.0-1ubuntu2.19+esm20, 7.58.0-2ubuntu3.24+esm14, 7.68.0-1ubuntu2.25+esm9, 7.81.0-1ubuntu1.29, 8.5.0-2ubuntu10.15, 8.18.0-1ubuntu2.7