Executive brief
curl is a widely-used library and command-line tool for transferring data over HTTP and HTTPS. This vulnerability allows an attacker to trick curl into sending sensitive session cookies over unencrypted HTTP connections by using a tab character instead of a space in a Set-Cookie header. An attacker-controlled web server or network position could exploit this to intercept and steal session cookies, potentially leading to account hijacking or unauthorized access to sensitive data.
Technical details
The vulnerability is an information disclosure flaw (CWE-201) in curl's cookie handling logic. When parsing a Set-Cookie header, curl fails to properly recognize the Secure attribute if it is preceded by a tab character (ASCII 9) instead of a standard space (ASCII 32). This causes curl to store the cookie without the Secure flag set, making it eligible for transmission over plaintext HTTP. The flaw affects both the libcurl library and curl command-line tool. An attacker controlling a malicious server or intercepting HTTP responses can craft a malicious Set-Cookie header to exploit this parsing weakness, resulting in secure session cookies being transmitted unencrypted on subsequent requests.
Affected products
- curl curl 8.13.0 to 8.21.0 (multiple ranges: 8.13.0–8.14.1, 8.15.0–8.16.0, 8.17.0–8.20.0, 8.21.0)
Timeline
- 2026-09-02: disclosed: curl 8.22.0 released with fix, coordinated with advisory publication
- 2026-08-26: other: Vulnerability reported to curl project