CVE-2026-80255

⚠️ high

Summary

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

CVSS Score

7.5

High

EPSS Score

0.7

Exploit Probability

Published Date

2026-09-06

First Seen: 2026-09-07

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.8% of all 358,566 vulnerabilities in our database.

#115,475

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Sep 8, 2026

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

Stanislav Fort (Aisle Research) Daniel Stenberg (remediation developer)

SSVC data provided by CISA

Last Modified 2026-09-15

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE IDs (Weakness Types)

CWE-201

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
haxx	curl	Affected	> 8.13.0 < 8.22.0

🔗 References 3

https://curl.se/docs/CVE-2026-80255.html

Patch Vendor Advisory

https://curl.se/docs/CVE-2026-80255.json

Vendor Advisory

https://hackerone.com/reports/3972395

Exploit Mitigation Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-13608	⚠️ high	7.4	0.6	A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpre...	2026-09-06
CVE-2026-18924	⛔ critical	9.1	0.9	A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with othe...	2026-09-06
CVE-2026-19931	⛔ critical	9.8	1.2	A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, w...	2026-09-06
CVE-2026-80229	⚠️ high	7.5	0.9	When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy han...	2026-09-06
CVE-2026-80230	⚠️ high	7.5	0.6	When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VER...	2026-09-06
CVE-2026-80231	⚠️ high	7.5	0.9	A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a diffe...	2026-09-06

These CVEs affect the same products