CVE-2026-80255: curl Information Disclosure Vulnerability

CVE-2026-80255 Overview

CVE-2026-80255 affects curl's cookie parser. A Set-Cookie: response header that places a horizontal tab character (ASCII 9) instead of a space (ASCII 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie can subsequently be transmitted over plaintext HTTP to the same host, exposing session tokens or authentication material to network attackers. The issue is classified under [CWE-201: Insertion of Sensitive Information Into Sent Data].

Critical Impact
Cookies intended to be transmitted only over HTTPS may be sent in cleartext, enabling interception of session identifiers and other sensitive values by network-positioned adversaries.

Affected Products

curl (command-line tool)
libcurl (HTTP client library)
Applications and language bindings that depend on libcurl for cookie handling

Discovery Timeline

2026-09-06 - CVE-2026-80255 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-80255

Vulnerability Analysis

The defect lives in curl's Set-Cookie header parser. When curl processes cookie attributes, it splits the header into tokens using space as the expected delimiter. When a server emits a header such as Set-Cookie: name=value;\tSecure, the tab character preceding Secure is not recognized as a valid attribute separator. As a result, the Secure attribute is not parsed, and the cookie is stored in the cookie jar without the flag set.

A cookie stored without the Secure flag is eligible for transmission over any subsequent request to the same host, including http:// URLs. If the client later contacts the origin over cleartext HTTP, curl attaches the cookie to that request. An attacker able to observe or intercept network traffic can then capture the cookie value.

The vulnerability is remotely triggerable because a malicious or compromised HTTP server controls the exact byte sequence in the response header. Exploitation requires no authentication or user interaction beyond the client issuing a request to a host that returns a crafted Set-Cookie header.

Root Cause

The parser treats only the space character as the whitespace delimiter between the semicolon-separated cookie attribute list and the attribute name. RFC 6265 permits optional whitespace, which includes tab. The mismatch between the specification and curl's tokenizer causes the Secure attribute to be silently discarded.

Attack Vector

An attacker who controls an origin server, a reverse proxy, or a compromised upstream can emit a Set-Cookie response header containing a tab byte immediately before Secure. curl stores the cookie without the flag. Any later request curl makes to the same host over HTTP will include the cookie, allowing an on-path attacker to read it. The condition can also be triggered by a man-in-the-middle who rewrites HTTPS responses in specific downgrade scenarios, or by a legitimate but misconfigured server that emits tab-delimited headers.

See the cURL CVE-2026-80255 advisory and HackerOne Report #3972395 for the reporter's technical write-up.

Detection Methods for CVE-2026-80255

Indicators of Compromise

Cookies present in a curl cookie jar (-c/--cookie-jar output) that lack the TRUE/FALSE Secure column value expected for sensitive session cookies.
HTTP requests originating from curl-based clients that carry session cookies to http:// URLs after those cookies were first issued over HTTPS.
Server logs showing Set-Cookie response headers containing tab bytes (0x09) adjacent to the Secure token.

Detection Strategies

Inspect network captures for Set-Cookie headers containing \t before attribute names, particularly Secure and HttpOnly.
Audit stored cookie jars produced by curl and libcurl-based automation for missing Secure flags on cookies known to be issued as Secure.
Correlate outbound HTTP traffic from application hosts with the expected TLS-only destinations for session identifiers.

Monitoring Recommendations

Log and alert on plaintext HTTP requests carrying cookies that also appear in HTTPS session flows to the same host.
Track curl and libcurl versions across build pipelines, container images, and endpoints so unpatched instances are inventoried.
Monitor upstream response headers at reverse proxies to detect anomalous whitespace in Set-Cookie values.

How to Mitigate CVE-2026-80255

Immediate Actions Required

Upgrade curl and libcurl to the fixed release identified in the cURL CVE-2026-80255 advisory as soon as it is available in your distribution channel.
Rebuild and redeploy container images, statically linked binaries, and language runtimes that bundle libcurl.
Rotate session cookies and authentication tokens for services accessed by curl-based clients if evidence of cleartext transmission exists.

Patch Information

The curl project has published details and patch references at the cURL CVE-2026-80255 advisory and in the corresponding cURL CVE-2026-80255 JSON metadata. Apply the vendor patch and verify the installed version reports the fixed release.

Workarounds

Enforce HTTPS-only communication for hosts that issue sensitive cookies, for example by using --proto =https or HSTS pinning at the client.
Configure origin servers and reverse proxies to normalize Set-Cookie headers so attributes are separated by a single space character.
Restrict curl-based automation from following redirects that downgrade from https:// to http:// using --proto-redir =https.

bash

# Enforce HTTPS at the curl client to prevent cleartext cookie transmission
curl --proto '=https' --proto-redir '=https' \
     -b cookies.txt -c cookies.txt \
     https://example.com/api