UpHeron
All vulnerabilities

Servers and applications

CVE-2026-80255

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Severity
High 7.5
Published
6 Sept 2026
Last changed
15 Sept 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.22.0
Sources
NVD

Affected software

SoftwareAffected versions
curlServers and applications · cpe:a:haxx:curl
  • From 8.13.0 before 8.22.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-80255
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-80255