High severity · published Sep 6, 2026
CVE-2026-80255
secure cookie attribute bypass with tab
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of
space (ascii code 32) immediately before the `Secure` attribute causes curl to
store the cookie without its Secure flag. The cookie might then wrongfully be
sent over plaintext HTTP on subsequent requests to the same host.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CU
curl · curl
8.13.0 before 8.14.2; 8.15.0 before 8.16.1; 8.17.0 before 8.20.1; 8.21.0 before 8.22.0; 1aea05a6c2699e80c75936d58569851555acd603 before 4f6aa41a0145e930e766775dbe860883d350aa0a; 8.21.0; +9 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80255
Patch
https://curl.se/docs/CVE-2026-80255.html
Vendor Advisory
https://curl.se/docs/CVE-2026-80255.json
Exploit
https://hackerone.com/reports/3972395
More from curl
9.8
CVE-2026-19931
Negotiate ambient user conn reuse
9.8
CVE-2026-9079
stale proxy password leak
9.8
CVE-2026-8925
SASL double-free
9.8
CVE-2026-11856
cross-origin Digest auth state leak
9.8
CVE-2026-10536
HTTP/2 stream-dependency tree UAF