CVE-2026-6276

Katalog CVE

CVSS 7.5 · High EPSS 0,35%

Kerentanan Origin Validation Error pada haxx curl. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

Rincian

Terbit di NVD

13 Mei 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-346: Origin Validation Error
CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2026-6276.html patch · advisory vendor
• https://hackerone.com/reports/3671818 exploit · issue tracking · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/04/29/13 mailing list · advisory pihak ketiga
• https://curl.se/docs/CVE-2026-6276.json product