CVE-2026-6276

A flaw was found in libcurl. This vulnerability allows for information disclosure when a custom Host: header is used in an initial HTTP request, and a subsequent request reuses the same connection without specifying a new Host: header. This can lead to libcurl incorrectly sending cookies intended for the first host to the second host, resulting in a cookie leak. This issue is categorized as an Origin Validation Error (CWE-346). Exploitation typically requires specific debugging configurations.

This Low severity flaw affects libcurl when a custom Host: header is initially set for an HTTP request, and a subsequent request uses the same easy handle without a custom Host: header. This can lead to the second request sending cookies intended for the first host. The curl command-line tool is not affected by this issue. Exploitation typically requires specific debugging configurations, reducing its overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, avoid using custom Host: headers with libcurl, especially when reusing the same easy handle for multiple requests. This vulnerability primarily arises from specific debugging configurations.