CVE-2026-80255

HIGH 7.5

secure cookie attribute bypass with tab

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

CWE	CWE-201
Vendor	curl
Product	curl
Published	Sep 6, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for curl curl

Be the first to know when new high vulnerabilities affecting curl curl are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

curl / curl

8.13.0 < 8.14.2 8.15.0 < 8.16.1 8.17.0 < 8.20.1 8.21.0 < 8.22.0

curl / curl

1aea05a6c2699e80c75936d58569851555acd603 < 4f6aa41a0145e930e766775dbe860883d350aa0a

curl / curl

8.21.0 8.20.0 8.19.0 8.18.0 8.17.0 8.16.0 8.15.0 8.14.1 8.14.0 8.13.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

curl.se: https://curl.se/docs/CVE-2026-80255.json curl.se: https://curl.se/docs/CVE-2026-80255.html hackerone.com: https://hackerone.com/reports/3972395

Credits

Stanislav Fort (Aisle Research) Daniel Stenberg