CVE-2026-80255: 
cURL vulnerability analysis and mitigation

CVE-2026-80255 is a "Secure" cookie attribute bypass vulnerability in curl caused by the use of a tab character instead of a space before the Secure attribute in a Set-Cookie: header. Affected versions span curl 8.13.0 through 8.21.0 (inclusive); versions below 7.13.0 and 8.22.0 or later are not affected. The vulnerability was reported to the curl project on August 26, 2026, and curl 8.22.0 was released on September 2, 2026, coordinated with public disclosure. It is classified as Low severity and assigned CWE-201 (Information Exposure Through Sent Data) (curl Advisory).

The root cause is improper parsing of the Set-Cookie: header: when a horizontal tab character (ASCII 0x09) appears immediately before the Secure attribute instead of the expected space (ASCII 0x20), curl fails to recognize the Secure flag and stores the cookie without it (CWE-201). As a result, on subsequent requests to the same host over plaintext HTTP, curl may transmit the cookie that was intended to be restricted to HTTPS connections. The flaw affects both the libcurl library and the curl command-line tool, and was introduced in commit 1aea05a6c2699e80c75936d5 (curl Advisory, oss-sec). No special privileges or authentication are required on the client side; exploitation depends on a server (or attacker-controlled intermediary) sending a maliciously crafted Set-Cookie: header.

If exploited, a cookie marked Secure by the server may be silently downgraded and transmitted over unencrypted HTTP connections, exposing potentially sensitive session tokens or authentication cookies to network eavesdroppers. The confidentiality impact is the primary concern — integrity and availability are not directly affected. The risk is highest in environments where HTTP redirects or mixed-content scenarios are possible, as an attacker performing a man-in-the-middle or network interception could capture the leaked cookie (curl Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires a server or attacker-controlled response to deliver a specially crafted Set-Cookie: header with a tab character before the Secure attribute, limiting opportunistic exploitation. The CVE status is listed as "Reserved" and no EPSS score or CISA KEV catalog entry has been published. The vulnerability was discovered and reported by Stanislav Fort of Aisle Research (curl Advisory, Aisle Blog).

1. Set up a malicious or compromised server: Configure a web server to respond with a Set-Cookie: header where a tab character (\t, ASCII 0x09) precedes the Secure attribute, e.g., Set-Cookie: session=abc123;\tSecure; HttpOnly.
2. Induce the curl client to connect: Lure or redirect the target curl client (or application using libcurl 8.13.0–8.21.0) to make an HTTPS request to the controlled server, causing it to receive and store the malformed cookie without the Secure flag.
3. Trigger a plaintext HTTP request: Cause the curl client to make a subsequent HTTP (non-TLS) request to the same host — for example, via an HTTP redirect or a mixed-content resource load.
4. Intercept the cookie: Perform network interception (e.g., via ARP spoofing, rogue Wi-Fi, or passive monitoring on the same network segment) to capture the cookie transmitted in plaintext over HTTP.
5. Use the captured cookie: Replay the stolen session cookie against the legitimate HTTPS service to hijack the victim's session (curl Advisory).

• Network: Outbound HTTP (plaintext, port 80) requests from a curl/libcurl client carrying Cookie: headers with values that should only appear on HTTPS connections; unexpected HTTP requests to hosts that normally communicate exclusively over HTTPS.
• Logs: Server-side access logs showing cookie values appearing in HTTP requests that were previously only seen in HTTPS sessions; curl verbose logs (--verbose) showing Cookie: headers sent on http:// URLs.
• Application: Unexpected session activity or authentication events originating from IP addresses inconsistent with the legitimate user, potentially indicating session hijacking after cookie interception (curl Advisory).

The primary remediation is to upgrade curl and libcurl to version 8.22.0 or later, which includes the fix (commit 4f6aa41a0145e930e76677). If upgrading immediately is not possible, applying the upstream patch and rebuilding is the next best option. As a configuration-level workaround, avoid using cleartext HTTP transfers in any workflow that involves cookies, and enforce HTTPS-only communication at the application or network level (curl Advisory).

The vulnerability was one of six curl CVEs reported by Stanislav Fort of Aisle Research, which drew attention in the security community — particularly given the blog post's framing that Aisle discovered six curl CVEs after AI tools (OpenAI and Anthropic) found zero, generating discussion about AI-assisted vulnerability research (Aisle Blog). Daniel Stenberg (curl's lead maintainer) authored the patch and coordinated the release of curl 8.22.0 with the advisory, noting in his blog that this bug is not considered a C-language-specific mistake (Daniel Stenberg Blog). The oss-sec mailing list also carried the disclosure (oss-sec).