Skip to main content

curl EUVDEUVD-2026-29928

| CVE-2026-6276 HIGH
Cleartext Transmission of Sensitive Information (CWE-319)
2026-05-08 GHSA-2jc6-hc33-hv48
Information Disclosure Apple Jenkins Curl Haxx
High
Disputed · 7.5 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify libcurl app using custom cookie host
  2. Delivery
    Lure or redirect app to attacker-controlled host
  3. Exploit
    Reused easy handle retains stale cookie scope
  4. Execution
    libcurl attaches victim-host cookies to attacker request
  5. Persist
    Attacker logs Cookie header
  6. Impact
    Replay session token against original host

Vulnerability Assessment

Weakness
CWE
CWE-319
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V12 - Secure Communication Transport encryption
Exploitation Conditions

Exploitation requires an application using libcurl that (1) sets a custom cookie host scope via CURLOPT_COOKIELIST or equivalent cookie API, (2) reuses the same curl easy handle for subsequent requests to a different host without resetting it, and (3) sends that subsequent request to a host the attacker controls or observes. There is no special network position requirement beyond receiving the leaked request, but the bug does not trigger in default command-line curl usage that does not programmatically inject custom cookie hosts; deployments that never use custom cookie scoping are not exposed, which substantially limits the population of vulnerable real-world consumers.
Impact

Signals point in different directions and should be weighed together. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) is anomalous for a cookie-leak bug - the A:H rating is unusual for an information-disclosure flaw where one would expect C:H/I:N/A:N, suggesting NVD scoring may not yet reflect the true impact and should be verified against the curl advisory at curl.se. EPSS is 0.01% (1st percentile), the vulnerability is NOT on CISA KEV, and SSVC marks exploitation as 'poc' with 'partial' technical impact and 'automatable: yes'. Realistically this is a low-urgency patch-on-next-cycle issue for most consumers, but applications that programmatically set custom cookie hosts and reuse handles across redirects/hosts (proxies, scrapers, federated API clients) should treat it as a meaningful confidentiality bug. No public exploit identified at time of analysis.
Exploit ScenarioDerived

A malicious or attacker-controlled web service is contacted by an application that uses libcurl with a reused easy handle previously configured with a custom cookie host for a sensitive site (for example an internal API). Because the stale custom host scoping is not cleared, libcurl attaches cookies intended for the original host to the request bound for the attacker's server, which logs the Cookie header and harvests session tokens. No public PoC is identified at time of analysis, but SSVC marks exploitation as automatable.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 08, 2026

Cookie leakage in curl (libcurl) versions 7.71.0 through 8.19.0 allows remote servers to receive cookies intended for a different host when a stale custom cookie host value persists across requests. The flaw, tracked as CWE-319 (cleartext transmission of sensitive information), carries a CVSS 7.5 and SSVC 'partial' technical impact, with no public exploit identified at time of analysis and an EPSS of 0.01%.

RemediationAI

Patch available per vendor advisory - upgrade to the fixed curl release noted in the upstream advisory at https://curl.se/docs/CVE-2026-6276.html (consult the JSON form at https://curl.se/docs/CVE-2026-6276.json for the precise fix commit and tagged version, which were not enumerated in the provided data). For distribution-managed deployments apply Red Hat RHSA-2026:12916 or the relevant SUSE updates (SUSE-SU-2026:1717/1940/21440/21452). If patching is delayed, compensating controls include avoiding reuse of curl easy handles across requests to different hosts when CURLOPT_COOKIELIST or custom cookie host values are set, calling curl_easy_reset() between such requests, or disabling persistent cookie jars in affected automation; the trade-off is reduced connection reuse and lost cookie state between requests, which can break session-bound workflows.

Affected VersionsENISA

curl 8.14.0 ≤8.14.0
curl 8.4.0 ≤8.4.0
curl 8.1.1 ≤8.1.1
curl 7.83.1 ≤7.83.1
curl 8.11.1 ≤8.11.1
curl 8.11.0 ≤8.11.0
curl 7.71.1 ≤7.71.1
curl 8.2.0 ≤8.2.0
curl 7.83.0 ≤7.83.0
curl 8.9.0 ≤8.9.0
curl 7.86.0 ≤7.86.0
curl 7.87.0 ≤7.87.0
curl 7.72.0 ≤7.72.0
curl 7.80.0 ≤7.80.0
curl 8.13.0 ≤8.13.0
curl 7.88.0 ≤7.88.0
curl 8.6.0 ≤8.6.0
curl 7.79.0 ≤7.79.0
curl 7.79.1 ≤7.79.1
curl 8.7.1 ≤8.7.1
curl 8.14.1 ≤8.14.1
curl 8.10.0 ≤8.10.0
curl 8.10.1 ≤8.10.1
curl 7.82.0 ≤7.82.0
curl 7.77.0 ≤7.77.0
curl 8.17.0 ≤8.17.0
curl 7.76.1 ≤7.76.1
curl 8.5.0 ≤8.5.0
curl 8.0.1 ≤8.0.1
curl 7.74.0 ≤7.74.0
curl 8.12.1 ≤8.12.1
curl 8.1.2 ≤8.1.2
curl 8.1.0 ≤8.1.0
curl 7.71.0 ≤7.71.0
curl 7.81.0 ≤7.81.0
curl 8.0.0 ≤8.0.0
curl 7.73.0 ≤7.73.0
curl 8.16.0 ≤8.16.0
curl 8.15.0 ≤8.15.0
curl 8.18.0 ≤8.18.0
curl 7.88.1 ≤7.88.1
curl 7.75.0 ≤7.75.0
curl 8.7.0 ≤8.7.0
curl 8.12.0 ≤8.12.0
curl 8.9.1 ≤8.9.1
curl 8.2.1 ≤8.2.1
curl 8.8.0 ≤8.8.0
curl 8.3.0 ≤8.3.0
curl 7.78.0 ≤7.78.0
curl 7.84.0 ≤7.84.0
curl 7.76.0 ≤7.76.0
curl 7.85.0 ≤7.85.0
curl 8.19.0 ≤8.19.0

Affected Packages

euvd curl no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

curl/libcurl is the ubiquitous HTTP(S) client library maintained by Daniel Stenberg and the curl project (CPE cpe:2.3:a:haxx:curl). The bug is in curl's cookie engine: when an application sets a custom cookie host (via CURLOPT_COOKIELIST or similar APIs) and the easy handle is reused for a subsequent request to a different host, the previously-applied custom host scoping is not properly reset. CWE-319 captures the root cause class - sensitive data (the cookie) is transmitted in cleartext context to a party not entitled to it. Because the underlying transport may still be TLS, the integrity breach is one of cookie-scope confusion rather than wire-level eavesdropping.

Know when Curl gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
NVD PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 3.7 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 13, 2026 - 18:22 NVD
7.5 (HIGH)
CVE Published
May 08, 2026 - 06:45 nvd
UNKNOWN (no severity yet)
CVE Published
May 08, 2026 - 06:45 nvd
HIGH 7.5

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

libcurl versions 7.71.0-8.19.0 allow session authentication data to leak to unintended recipients, creating risk of user account compromise across dependent applications. No public exploit identified at time of analysis. Organizations must immediately inventory libcurl usage across their technology stack and apply patches to mitigate this exposure risk.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Threat Intel
1
1 sources
Social Media
2
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment CISA MSRC Vendor CIRCL VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Curl

View all
CVE-2021-22901 HIGH POC
8.1 Jun 11

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when
CVE-2013-0249 HIGH POC
7.5 Mar 08

Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7
CVE-2015-3145 HIGH
7.5 Apr 24

The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which

CVE-2022-32206 MEDIUM POC
6.5 Jul 07

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple t
CVE-2022-32207 CRITICAL POC
9.8 Jul 07

When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the

CVE-2022-43551 HIGH POC
7.5 Dec 23

A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Rated high seve
CVE-2022-32221 CRITICAL POC
9.8 Dec 05

When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data t
CVE-2018-0500 CRITICAL POC
9.8 Jul 11

Curl_smtp_escape_eob in lib/smtp.c in curl 7.54.1 to and including curl 7.60.0 has a heap-based buffer overflow that mig
CVE-2022-32205 MEDIUM POC
4.3 Jul 07

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 sto
CVE-2025-9086 HIGH POC
7.5 Sep 12

1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack co
CVE-2023-23914 CRITICAL POC
9.1 Feb 23

A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause HSTS functional
CVE-2023-27534 HIGH POC
8.8 Mar 30

A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly re

Same weakness CWE-319 – Cleartext Transmission of Sensitive Information

View all
CVE-2025-26199 CRITICAL POC
9.8
CVE-2025-32880 CRITICAL POC
9.8
CVE-2023-33730 CRITICAL POC
9.8
CVE-2019-15911 CRITICAL POC
9.8
CVE-2019-18852 CRITICAL POC
9.8
CVE-2024-25735 CRITICAL POC
9.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/4.3/proxy-httpd:4.3.17.9.76.18 Container suse/manager/4.3/proxy-salt-broker:4.3.17.9.66.20 Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.106 Container suse/sle-micro/5.3/toolbox:16.3-6.11.222 Container suse/sle-micro/5.4/toolbox:16.3-5.19.222 Container suse/sle-micro/5.5/toolbox:16.3-3.12.133 Container suse/sle-micro/base-5.5:2.0.4-5.8.271 Image SLES15-SP4-BYOS Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-EC2 Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-CHOST-BYOS Image SLES15-SP4-CHOST-BYOS-Aliyun Image SLES15-SP4-CHOST-BYOS-Azure Image SLES15-SP4-CHOST-BYOS-EC2 Image SLES15-SP4-CHOST-BYOS-GCE Image SLES15-SP4-CHOST-BYOS-SAP-CCloud Image SLES15-SP4-HPC-BYOS Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-EC2 Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-EC2 Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-EC2 Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP5-BYOS-Azure Image SLES15-SP5-BYOS-EC2 Image SLES15-SP5-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-Aliyun Image SLES15-SP5-CHOST-BYOS-Azure Image SLES15-SP5-CHOST-BYOS-EC2 Image SLES15-SP5-CHOST-BYOS-GCE Image SLES15-SP5-CHOST-BYOS-GDC Image SLES15-SP5-CHOST-BYOS-SAP-CCloud Image SLES15-SP5-EC2 Image SLES15-SP5-GCE Image SLES15-SP5-HPC-BYOS-Azure Image SLES15-SP5-HPC-BYOS-EC2 Image SLES15-SP5-HPC-BYOS-GCE Image SLES15-SP5-Hardened-BYOS-Azure Image SLES15-SP5-Hardened-BYOS-EC2 Image SLES15-SP5-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Azure-3P Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.172 Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.155 Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.168 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.139 Container suse/sl-micro/6.0/toolbox:13.2-9.105 Image SL-Micro Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.102 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.127 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.116 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.126 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-293-05
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:12916 ADVISORY https://curl.se/docs/CVE-2026-6276.html ADVISORY https://curl.se/docs/CVE-2026-6276.json ADVISORY https://hackerone.com/reports/3671818 ADVISORY https://vuldb.com/vuln/360238 ADVISORY https://www.openwall.com/lists/oss-security/2026/04/29 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1717/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1940/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21440/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21452/ REF http://www.openwall.com/lists/oss-security/2026/04/29/13

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy