CVE-2026-80255

HighCVSS 7.5/10Last modified Sep 15, 2026

Description

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-201

Affected software

Vendor	Product	Versions
curl	curl	>= 8.13.0, < 8.14.2; >= 8.15.0, < 8.16.1; >= 8.17.0, < 8.20.1; >= 8.21.0, < 8.22.0
curl	curl	>= 1aea05a6c2699e80c75936d58569851555acd603, < 4f6aa41a0145e930e766775dbe860883d350aa0a
curl	curl	8.21.0; 8.20.0; 8.19.0; 8.18.0; 8.17.0; 8.16.0; 8.15.0; 8.14.1; 8.14.0; 8.13.0

References

https://curl.se/docs/CVE-2026-80255.htmlPatch, Vendor Advisory
https://curl.se/docs/CVE-2026-80255.jsonVendor Advisory
https://hackerone.com/reports/3972395Exploit, Mitigation, Third Party Advisory
https://hackerone.com/reports/3972395Exploit, Mitigation, Third Party Advisory

Timeline

Published: Sep 6, 2026
Last modified: Sep 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-80265.3A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterp CVE-2026-80274.3A weakness has been identified in FlowiseAI Flowise up to 3.0.12. Affected by this vulnerability is an unknown functionality of the componen CVE-2026-802747.5If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer a CVE-2026-802758.8Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an a CVE-2026-802767.5Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface CVE-2026-80283.7A vulnerability was detected in FlowiseAI Flowise up to 3.0.12. This affects the function verify of the file packages/server/src/enterprise/CVE-2026-80293.9The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements to query sensitive d CVE-2026-802988.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platfor CVE-2026-80304.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th CVE-2026-803018.8Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox to access COM interf CVE-2026-803028.8Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged attacker executing inside th CVE-2026-803036.2An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial of service by causin