CVE-2026-80255
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Sep 6, 2026
CISA due date
—
The record
A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-82209 When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary… CWE-201
- CVE-2026-64643 Next.js is a React framework for building full-stack web applications. CWE-201
- CVE-2026-54171 Excon is usable, fast, simple HTTP 1.1 for Ruby. CWE-201
- CVE-2026-42505 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network… CWE-201
- CVE-2026-57318 Subscriber Sensitive Data Exposure in Site Reviews <= 8.0.11 versions. CWE-201
- CVE-2026-54834 Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. CWE-201
- CVE-2026-55180 pnpm is a package manager. CWE-201
- CVE-2026-54848 Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts… CWE-201