CVE-2026-80255

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Insertion of Sensitive Information Into Sent Data pada haxx curl. Skor CVSS 3.1 7.5 (High) menurut CISA ADP.

Deskripsi (NVD)

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Rincian

Terbit di NVD

6 September 2026

Terakhir diubah

15 September 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-201: Insertion of Sensitive Information Into Sent Data

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2026-80255.html patch · advisory vendor
• https://curl.se/docs/CVE-2026-80255.json advisory vendor
• https://hackerone.com/reports/3972395 exploit · mitigasi · advisory pihak ketiga