CVE-2026-6276: stale custom cookie host causes cookie leak
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6276?
CVE-2026-6276 is considered a moderate severity vulnerability due to the risk of cookie leakage.
How do I fix CVE-2026-6276?
To fix CVE-2026-6276, ensure that custom Host headers are properly managed and avoid using stale requests without resetting the Host header.
What kind of applications are affected by CVE-2026-6276?
CVE-2026-6276 affects applications that use libcurl for HTTP requests with custom Host headers.
What is the impact of CVE-2026-6276 on user privacy?
The impact of CVE-2026-6276 on user privacy includes the potential exposure of sensitive cookies to unintended hosts.
When was CVE-2026-6276 reported?
CVE-2026-6276 was reported in 2026, highlighting the importance of managing HTTP request headers securely.