Severity by source
Network vector because cookie is exposed over HTTP; AC:H because attacker needs a tab-crafted Set-Cookie plus HTTP-observable subsequent request; C:L for cookie-value disclosure only.
Lifecycle Timeline
2Description PRE-NVD
AnalysisAI
Secure cookie attribute bypass in curl allows the Secure flag on HTTP cookies to be circumvented when a tab character is present in a Set-Cookie header, causing curl to potentially transmit cookies over unencrypted HTTP connections that should be restricted to HTTPS only. The flaw affects the cookie parsing logic in curl/libcurl and is fixed in curl 8.22.0, released September 2, 2026. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concurrent conditions: (1) the victim application uses curl or libcurl to communicate with a server that issues a `Set-Cookie` header containing a tab character positioned to disrupt `Secure` attribute parsing - this can be attacker-controlled or a legitimate server whose response is tampered with in transit; and (2) curl subsequently makes at least one HTTP (non-TLS) request to a domain in scope for the affected cookie, allowing a network observer to intercept the transmission. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector was provided in the input data, so all metric assessments below are independently derived. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to curl 8.22.0 (released September 2, 2026), which contains the fix for CVE-2026-80255 alongside patches for eight other vulnerabilities in the same release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of curl and libcurl across the organization, including development environments, production systems, containerized services, API clients, embedded tools, and CI/CD infrastructure; prioritize systems handling authentication or sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today