Vulnerability in Curl Affects Cookie Security

CVE-2026-80255

What is CVE-2026-80255?

A vulnerability in Curl arises from a malformed Set-Cookie: header that uses a tab character instead of a space before the Secure attribute. This improper formatting allows Curl to store the cookie without the Secure flag set, which can lead to sensitive information being transmitted over unencrypted HTTP connections in later requests to the same domain. This poses significant risks as sensitive data may be intercepted by malicious actors targeting unprotected transmissions.

References