CVE-2026-6276 stale custom cookie host causes cookie leak
Attackers can steal cookies from a previous request when reusing a libcurl easy handle with a changed Host header.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6276?
CVE-2026-6276 is a high-severity vulnerability in Haxx Curl, published on 13 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
Which versions are affected by CVE-2026-6276?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-6276?
Upgrade to a fixed version.
Is CVE-2026-6276 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6276 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-6276, AZL-86655, AZL-86679, BELL-CVE-2026-6276, CLSA-2026-1785773934, CLSA-2026-1792808992 and 14 more.