CVE-2026-80255 secure cookie attribute bypass with tab
Attackers can bypass the Secure cookie flag in curl by using tabs in headers, causing sensitive cookies to be sent over insecure HTTP connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80255?
CVE-2026-80255 is a high-severity vulnerability in Haxx Curl, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Weakness: CWE-201
Which versions are affected by CVE-2026-80255?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2026-80255?
Upgrade to a fixed version.
Is CVE-2026-80255 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-80255 exists.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2026-80255, AZL-99810, AZL-99828, AZL-99864, BELL-CVE-2026-80255, CURL-CVE-2026-80255 and 10 more.