CVE-2026-6276: stale custom cookie host causes cookie leak
stale custom cookie host causes cookie leak
Other sources
Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.11.1-7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.30.3-14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6276?
CVE-2026-6276 is considered a moderate severity vulnerability due to the risk of cookie leakage.
How do I fix CVE-2026-6276?
To fix CVE-2026-6276, ensure that custom Host headers are properly managed and avoid using stale requests without resetting the Host header.
What kind of applications are affected by CVE-2026-6276?
CVE-2026-6276 affects applications that use libcurl for HTTP requests with custom Host headers.
What is the impact of CVE-2026-6276 on user privacy?
The impact of CVE-2026-6276 on user privacy includes the potential exposure of sensitive cookies to unintended hosts.
When was CVE-2026-6276 reported?
CVE-2026-6276 was reported in 2026, highlighting the importance of managing HTTP request headers securely.