curl Cookie Handling Issue with Tab Character in Set-Cookie Header

Executive Summary

CVE-2026-80255 is a vulnerability in curl where a Set-Cookie header uses a tab character instead of a space before the Secure attribute. This causes curl to store the cookie without the Secure flag, allowing it to be sent over plaintext HTTP in future requests.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect HTTP responses for Set-Cookie headers containing a tab character before the Secure attribute. Use tools like curl to fetch headers and grep for patterns like 'Set-Cookie:.* Secure'. Check curl versions between 8.13.0 and 8.21.0 for potential exposure.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could expose sensitive data by allowing cookies to be sent over unencrypted HTTP connections. If an attacker intercepts these requests, they might access session tokens or other sensitive information stored in cookies.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive data transmitted over unencrypted HTTP connections due to improper handling of Secure cookies. If cookies containing personal or health data are sent over plaintext HTTP, it may violate encryption requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade curl to version 8.22.0 or later. If upgrading is not possible, avoid using cleartext HTTP transfers with cookies. Monitor network traffic for malformed Set-Cookie headers.

Useful 0 Not Useful 0