Is CVE-2026-80255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80255 being exploited in the wild.

How severe is CVE-2026-80255?

High severity, with a CVSS score of 7.5, published 6 September 2026.

Which products and versions are affected?

curl curl 8.13.0 to 8.21.0 (multiple ranges: 8.13.0–8.14.1, 8.15.0–8.16.0, 8.17.0–8.20.0, 8.21.0).

Is there a fix for CVE-2026-80255?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80255 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-80255?

Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80255: curl secure cookie attribute bypass with tab

CVE-2026-80255 · Severity: high · CVSS 7.5 · Published 2026-09-06

curl is a widely-used library and command-line tool for transferring data over HTTP and HTTPS. This vulnerability allows an attacker to trick curl into sending sensitive session cookies over unencrypted HTTP connections by using a tab character instead of a space in a Set-Cookie header. An attacker-controlled web server or network position could exploit this to intercept and steal session cookies, potentially leading to account hijacking or unauthorized access to sensitive data.

Technologies: Haxx Curl. Vendors: Haxx.

Quick answers

Is CVE-2026-80255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80255 being exploited in the wild.
How severe is CVE-2026-80255?: High severity, with a CVSS score of 7.5, published 6 September 2026.
Which products and versions are affected?: curl curl 8.13.0 to 8.21.0 (multiple ranges: 8.13.0–8.14.1, 8.15.0–8.16.0, 8.17.0–8.20.0, 8.21.0).
Is there a fix for CVE-2026-80255?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80255 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-80255?: Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure flaw (CWE-201) in curl's cookie handling logic. When parsing a Set-Cookie header, curl fails to properly recognize the Secure attribute if it is preceded by a tab character (ASCII 9) instead of a standard space (ASCII 32). This causes curl to store the cookie without the Secure flag set, making it eligible for transmission over plaintext HTTP. The flaw affects both the libcurl library and curl command-line tool. An attacker controlling a malicious server or intercepting HTTP responses can craft a malicious Set-Cookie header to exploit this parsing weakness, resulting in secure session cookies being transmitted unencrypted on subsequent requests.

Affected products

curl curl 8.13.0 to 8.21.0 (multiple ranges: 8.13.0–8.14.1, 8.15.0–8.16.0, 8.17.0–8.20.0, 8.21.0)

Timeline

2026-09-02: disclosed: curl 8.22.0 released with fix, coordinated with advisory publication
2026-08-26: other: Vulnerability reported to curl project

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.