CVE-2026-63481: Hurl cookie leak on cross-host redirects

CVE-2026-63481 · Severity: medium · CVSS 6.9 · Published 2026-09-02

Executive brief

Hurl is a command-line HTTP testing tool that allows users to define test scenarios in .hurl files, including cookies for authentication and session management. In versions 8.0.1 and earlier, when Hurl follows an HTTP redirect to a different host, cookies defined in the dedicated [Cookies] section are not stripped and leak to the redirected host—unlike cookies in the Cookie header, which are correctly removed. An attacker controlling a malicious redirect target could intercept sensitive session or authentication cookies intended for the original host.

Technical details

This is a credential-leak vulnerability in Hurl's redirect handling logic (CWE-201: Insertion of Sensitive Information Into Sent Data). Hurl supports two cookie definition methods in .hurl files: (1) raw Cookie headers in the [Headers] section, and (2) a dedicated [Cookies] section. When following a cross-host redirect, Hurl strips Authorization headers, basic-auth credentials, and cookies from the Cookie header to prevent credential leakage—mirroring libcurl's default behavior. However, the code only checked and stripped the Cookie header, not the structured cookies from the [Cookies] section. An attacker can craft a .hurl test file with cookies in the [Cookies] section and trigger a redirect to a different host; those cookies will be sent to the attacker-controlled second host. The vulnerability affects Hurl versions up to and including 8.0.1. A fix was merged in PR #5119 (commit ed91c89) and released in version 8.1.0, which strips cookies from the [Cookies] section during cross-host redirects.

CVE-2026-63481: Hurl cookie leak on cross-host redirects

Executive brief

Technical details

Affected products

Timeline

References