# CVE-2026-80255: curl secure cookie attribute bypass with tab

Source: https://junglewise.ai/threats/cve-2026-80255-curl-secure-cookie-attribute-bypass-with-tab  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-80255 · Severity: high · CVSS 7.5 · Published 2026-09-06

curl is a widely-used library and command-line tool for transferring data over HTTP and HTTPS. This vulnerability allows an attacker to trick curl into sending sensitive session cookies over unencrypted HTTP connections by using a tab character instead of a space in a Set-Cookie header. An attacker-controlled web server or network position could exploit this to intercept and steal session cookies, potentially leading to account hijacking or unauthorized access to sensitive data.

Technologies: [Haxx Curl](https://junglewise.ai/threats/technologies/curl). Vendors: [Haxx](https://junglewise.ai/threats/vendors/haxx).

## Quick answers

**Is CVE-2026-80255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80255 being exploited in the wild.

**How severe is CVE-2026-80255?** High severity, with a CVSS score of 7.5, published 6 September 2026.

**Which products and versions are affected?** curl curl 8.13.0 to 8.21.0 (multiple ranges: 8.13.0–8.14.1, 8.15.0–8.16.0, 8.17.0–8.20.0, 8.21.0).

**Is there a fix for CVE-2026-80255?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80255 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-80255?** Check whether you run Haxx Curl. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an information disclosure flaw (CWE-201) in curl's cookie handling logic. When parsing a Set-Cookie header, curl fails to properly recognize the Secure attribute if it is preceded by a tab character (ASCII 9) instead of a standard space (ASCII 32). This causes curl to store the cookie without the Secure flag set, making it eligible for transmission over plaintext HTTP. The flaw affects both the libcurl library and curl command-line tool. An attacker controlling a malicious server or intercepting HTTP responses can craft a malicious Set-Cookie header to exploit this parsing weakness, resulting in secure session cookies being transmitted unencrypted on subsequent requests.

## Affected products

- curl curl 8.13.0 to 8.21.0 (multiple ranges: 8.13.0–8.14.1, 8.15.0–8.16.0, 8.17.0–8.20.0, 8.21.0)

## Timeline

- 2026-09-02: disclosed: curl 8.22.0 released with fix, coordinated with advisory publication
- 2026-08-26: other: Vulnerability reported to curl project

## References

- [https://curl.se/docs/CVE-2026-80255.html](https://curl.se/docs/CVE-2026-80255.html)
- [https://curl.se/docs/CVE-2026-80255.json](https://curl.se/docs/CVE-2026-80255.json)

## Related threats

- [curl Public Suffix List domain boundary check bypass in cookie handling](https://junglewise.ai/threats/cve-2026-82209-curl-public-suffix-list-domain-boundary-check-bypass-in-cookie)
- [curl libcurl certificate validation bypass in wolfSSL backend](https://junglewise.ai/threats/cve-2026-82208-curl-libcurl-certificate-validation-bypass-in-wolfssl-backend)
- [curl HTTPS connection reuse with mismatched CA store settings](https://junglewise.ai/threats/cve-2026-80231-curl-https-connection-reuse-with-mismatched-ca-store-settings)
- [curl public key pinning bypass with disabled peer verification](https://junglewise.ai/threats/cve-2026-80230-curl-public-key-pinning-bypass-with-disabled-peer-verification)
- [curl OpenSSL provider use-after-free in TLS connections](https://junglewise.ai/threats/cve-2026-80229-curl-openssl-provider-use-after-free-in-tls-connections)