CVE-2026-80255

Name of the Vulnerable Software and Affected Versions curl (affected versions not specified)

Description A flaw exists where using a horizontal tab (ASCII code 9) instead of a space (ASCII code 32) immediately before the Secure attribute in a Set-Cookie: header causes the software to store the cookie without the Secure flag. This may result in the cookie being transmitted over plaintext HTTP during subsequent requests to the same host.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.