Is CVE-2026-6276 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6276 being exploited in the wild.

How severe is CVE-2026-6276?

High severity, with a CVSS score of 7.5, published 13 May 2026.

Is there a fix for CVE-2026-6276?

A patch was published on 2026-04-29: libcurl 8.20.0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6276 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6276?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6276: Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done…

CVE-2026-6276 · Severity: high · CVSS 7.5 · Published 2026-05-13

A vulnerability in the libcurl library, which is widely used by applications to transfer data over the internet, could lead to the accidental disclosure of sensitive information. When an application makes multiple requests using the same connection handle, it may mistakenly send security cookies intended for one website to a different, subsequent website. This could allow an attacker to intercept session tokens or other private user data if they control the second destination.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-6276 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6276 being exploited in the wild.
How severe is CVE-2026-6276?: High severity, with a CVSS score of 7.5, published 13 May 2026.
Which products and versions are affected?: curl libcurl 7.71.0 to 8.19.0.
Is there a fix for CVE-2026-6276?: A patch was published on 2026-04-29: libcurl 8.20.0 released. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6276 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6276?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An origin validation error (CWE-346) exists in libcurl when an 'easy handle' is reused for subsequent HTTP requests. If a developer sets a custom 'Host:' header for an initial request and then performs a second request using the same handle without that custom header, libcurl may retain stale host information. This causes the library to attach cookies belonging to the first host to the second request, even if the second request is destined for a different domain. The impact is primarily limited to clear-text HTTP transfers, as HTTPS transfers typically require matching SNI (Server Name Indication) which mitigates the risk of cross-domain leakage. The issue is fixed in version 8.20.0.

Affected products

curl libcurl 7.71.0 to 8.19.0

Timeline

2026-04-14: disclosed: Reported to the curl project via HackerOne.
2026-04-29: patched: libcurl 8.20.0 released.
2026-04-29: advisory: Project advisory published.
2026-05-13: other: NVD publication date.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.