CVE-2026-80255

A flaw was found in curl. When a Set-Cookie: header uses a tab character instead of a space before the Secure attribute, curl incorrectly stores the cookie without the Secure flag. This can lead to information disclosure, as the cookie may then be sent over unencrypted HTTP connections to the same host, potentially exposing sensitive data.

This Low impact information disclosure flaw in curl occurs when a Set-Cookie header uses a tab instead of a space before the Secure attribute. This misinterpretation can cause a secure cookie to be transmitted over an unencrypted HTTP connection, potentially exposing its contents to an attacker.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this enforce strict HTTPS-only communication (e.g., via HSTS and redirecting all HTTP traffic to HTTPS) across your web infrastructure to ensure curl cannot transmit data over plaintext HTTP. Alternatively, configure reverse proxies or load balancers to sanitize incoming HTTP headers by stripping or replacing horizontal tabs (HTAB) in Set-Cookie headers before they reach the client.