Description
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
Metrics
CVSS 3.1 7.5/10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| curl | curl | >= 7.71.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.20.0 |
| curl | curl | >= e15e51384a423be31318b3c9c7d612a1aae661fd, < 3a19987a87f393d9394fe5acc7643f6c263c92db |
| curl | curl | 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0; 8.12.1; 8.12.0; 8.11.1; 8.11.0; 8.10.1; 8.10.0; 8.9.1; 8.9.0; 8.8.0; 8.7.1; 8.7.0; 8.6.0 |
References
- https://curl.se/docs/CVE-2026-6276.htmlPatch, Vendor Advisory
- https://curl.se/docs/CVE-2026-6276.jsonProduct
- https://hackerone.com/reports/3671818Exploit, Issue Tracking, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2026/04/29/13Mailing List, Third Party Advisory
- https://hackerone.com/reports/3671818Exploit, Issue Tracking, Third Party Advisory
Timeline
- Published
- May 13, 2026
- Last modified
- Nov 11, 2026
- NVD status
- Modified