Every CVE Search/ Get API key

CVE-2026-80255

secure cookie attribute bypass with tab

7.5 HighFix available

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.48%Up 0.3 points since Sep 7, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

secure cookie attribute bypass with tab

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201, CWE-201
Updated
2026-11-02
EUVDEUVD-2026-72151 7.5

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
EUVD-2026-72151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vmmm-3jqx-jgx8 7.5

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32)...

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
GHSA-vmmm-3jqx-jgx8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
NVD 7.5

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-02
OSVALPINE-CVE-2026-80255 7.5

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
ALPINE-CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVBELL-CVE-2026-80255 7.5
Record
BELL-CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 18 moreShow less
OSV 7.5

secure cookie attribute bypass with tab

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-201
Updated
2026-11-03
OSVDEBIAN-CVE-2026-80255 7.5

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
DEBIAN-CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2026:63161 6.5

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Record
RHSA-2026:63161
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-80255 7.5

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
UBUNTU-CVE-2026-80255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVAZL-99810 No score

CVE-2026-80255 affecting package mysql 8.0.46-1

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
AZL-99810
Updated
2026-11-02
OSVAZL-99828 No score

CVE-2026-80255 affecting package rust 1.75.0-31

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
AZL-99828
Updated
2026-11-02
OSVAZL-99864 No score

CVE-2026-80255 affecting package rust 1.90.0-10

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
AZL-99864
Updated
2026-11-02
OSVCURL-CVE-2026-80255 No score

secure cookie attribute bypass with tab

A Set-Cookie: header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

Record
CURL-CVE-2026-80255
Updated
2026-11-02
OSVMGASA-2026-0515 No score

Updated curl package fixes security vulnerabilities

curl 8.23.0 has been released. It fixes 24 CVEs since 8.22.0, listed at https://curl.se/docs/security.html Not all of theses CVEs affect Mageia. Of the ones fixed in 8.23.0, these are the ones that do: CVE-2026-86410: redirect to SFTP or SCP bypasses host verification CVE-2026-86412: server-set cookie erases cookie jar CVE-2026-86413: Negotiate credentials sent to redirected origin CVE-2026-86414: leaking host credentials to HTTP proxy CVE-2026-86415: auto client cert connection reuse mixup CVE-2026-87861: cross-origin reuse of a Negotiate connection CVE-2026-87862: HSTS cache import drops longer-lived child CVE-2026-87863: HSTS response erases persisted entries CVE-2026-92386: server-set cookie aborts cookie jar load CVE-2026-92387: never-ending loop via server response omission CVE-2026-92388: FTP wildcard write callback mixup CVE-2026-92389: TFTP direction confusion CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints CVE-2026-92391: curl_mime_free stack overflow by recursion CVE-2026-92392: HTTP/2 upload Use-After-Free CVE-2026-94265: Authorization: Negotiate sent to foreign origin CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL CVE-2026-107929: local interface connection reuse mixup There were also some CVE IDs released at the same time that were fixed earlier, in 8.22.0, but just announced now: CVE-2026-86409: stale SigV4 headers sent unintended CVE-2026-86411: FTP connection reuse inherits client-certificate CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection Here are the CVEs fixed in 8.22.0, which wasn't released in mga10 and so are only getting fixed now: CVE-2026-13608: OpenLDAP SASL authentication bypass CVE-2026-18924: HTTP/2 server push UAF CVE-2026-19931: Negotiate ambient user conn reuse CVE-2026-80229: OpenSSL provider use-after-free CVE-2026-80230: OpenSSL pinning bypass CVE-2026-80255: secure cookie attribute bypass with tab CVE-2026-82209: domain-scoped PSL domain cookie

Record
MGASA-2026-0515
Updated
2026-11-02
OSVopenSUSE-SU-2026:11696-1 No score

curl-8.22.0-1.1 on GA media

These are all security issues fixed in the curl-8.22.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11696-1
Updated
2026-11-02
OSVROOT-OS-ALPINE-320-CVE-2026-80255 No score

CVE-2026-80255 in curl - Patched by Root

Root has patched CVE-2026-80255 in the curl package for Root:Alpine:3.20. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-320-CVE-2026-80255
Updated
2026-11-02
OSVROOT-OS-ALPINE-321-CVE-2026-80255 No score

CVE-2026-80255 in curl - Patched by Root

Root has patched CVE-2026-80255 in the curl package for Root:Alpine:3.21. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-321-CVE-2026-80255
Updated
2026-11-03
OSVROOT-OS-ALPINE-322-CVE-2026-80255 No score

CVE-2026-80255 in curl - Patched by Root

Root has patched CVE-2026-80255 in the curl package for Root:Alpine:3.22. Multiple fixed versions available.

Record
ROOT-OS-ALPINE-322-CVE-2026-80255
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-80255 No score

CVE-2026-80255 in curl - Patched by Root

Root has patched CVE-2026-80255 in the curl package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-80255
Updated
2026-11-03
OSVSUSE-SU-2026:4954-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).
Record
SUSE-SU-2026:4954-1
Updated
2026-11-02
OSVSUSE-SU-2026:5068-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated curl to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5068-1
Updated
2026-11-03
OSVSUSE-SU-2026:5069-1 No score

Security update for curl

This update for curl fixes the following issues:

  • CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
  • CVE-2026-9546: sending old referer (bsc#1268419).
  • CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop (bsc#1268423).
  • CVE-2026-11564: Native CA trust persist (bsc#1268424).
  • CVE-2026-11586: WS Auto-PONG memory exhaustion (bsc#1268425).
  • CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
  • CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).
  • CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
  • CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
  • CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
  • CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
  • CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
  • CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
  • CVE-2026-86411: FTP connection reuse inherits client-certificate (bsc#1285029).
  • CVE-2026-86412: server-set cookie erases cookie jar (bsc#1285028).
  • CVE-2026-86413: Negotiate credentials sent to redirected origin (bsc#1285027).
  • CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
  • CVE-2026-87861: cross-origin reuse of a Negotiate connection (bsc#1285024).
  • CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
  • CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
  • CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
  • CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
  • CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
  • CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
  • CVE-2026-92389: TFTP direction confusion (bsc#1285015).
  • CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
  • CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
  • CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
  • CVE-2026-94265: Authorization: Negotiate sent to foreign origin (bsc#1285011).
  • CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
  • CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Changes for curl:

  • Updated to version 8.22.0. (jsc#PED-16984)
Record
SUSE-SU-2026:5069-1
Updated
2026-11-03
OSVUSN-8820-1 No score

curl vulnerabilities

Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing connections between handles. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate verification was disabled in certain circumstances. A remote attacker could possibly use this issue to bypass pinning checks and cause curl to accept connections that should have been rejected. (CVE-2026-80230)

Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-82209)

Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete for Ubuntu 16.04 LTS. (CVE-2026-8927)

Record
USN-8820-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
curl
Alpine:v3.23
 8.13.0 up to 8.22.0-r0
8.22.0-r0
curl
Alpine:v3.24
 8.13.0 up to 8.22.0-r0
8.22.0-r0
mysql
Azure Linux:3
 through 8.0.46-1 None known
rust
Azure Linux:3
 through 1.75.0-31 None known
rust
Azure Linux:3
 1.85.0 to 1.90.0-10 None known
curl
Alpaquita:23
 8.1.0-r2 up to 8.22.0-r0
8.22.0-r0
curl
Alpaquita:25
 8.14.0-r1 up to 8.22.0-r0
8.22.0-r0
curl
Alpaquita:stream
 8.1.2-r0 up to 8.22.0-r0
8.22.0-r0
curl
BellSoft Hardened Containers:stream
 8.1.2-r0 up to 8.22.0-r0
8.22.0-r0
curl
Debian:13
 All versions, plus listed versions
8.14.1-28.14.1-2+deb13u18.14.1-2+deb13u28.14.1-2+deb13u2~bpo13+18.14.1-2+deb13u3
Show 45 moreShow less
8.14.1-2+deb13u48.14.1-2+deb13u58.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp18.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp
 None known
Show 37 moreShow less
Affected packages
PackageAffectedFixed
curl
Debian:14
 before 8.22.0-1, plus listed versions
8.14.1-28.14.1-2+exp18.15.0-18.15.0-1~bpo13+18.15.0-1~exp1
Show 45 moreShow less
8.15.0~rc1-1exp18.15.0~rc2-1~exp18.15.0~rc3-1~exp18.16.0-18.16.0-1+exp18.16.0-1~bpo13+18.16.0-28.16.0-38.16.0-48.16.0-4~bpo13+18.16.0~rc1-1~exp18.16.0~rc2-18.16.0~rc2-28.16.0~rc3-18.17.0-18.17.0-28.17.0-38.17.0~rc1-1~exp18.17.0~rc2-18.17.0~rc3-18.18.0-18.18.0-1~bpo13+18.18.0-28.18.0~rc1-1+exp18.18.0~rc2-18.18.0~rc3-18.19.0-18.19.0-1+exp18.19.0-1~bpo13+18.19.0-28.19.0-38.19.0-3+exp18.19.0-3+exp28.19.0~rc1-1~exp18.19.0~rc2-18.19.0~rc2-28.19.0~rc3-18.20.0-18.20.0-1+exp8.20.0-28.20.0-2+exp18.20.0-2~bpo13+18.20.0-38.20.0-48.20.0-5
8.22.0-1
curl
Mageia:10
From an advisory covering 31 CVEs
 before 8.23.0-1.mga10
8.23.0-1.mga10
curl
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:8.22.0-0.1.hum1
0:8.22.0-0.1.hum1
libcurl
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:8.22.0-0.1.hum1
0:8.22.0-0.1.hum1
libcurl-devel
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:8.22.0-0.1.hum1
0:8.22.0-0.1.hum1
libcurl-minimal
Red Hat:hummingbird:1
From an advisory covering 8 CVEs
 before 0:8.22.0-0.1.hum1
0:8.22.0-0.1.hum1
curl
Root:Alpine:3.20
 before 8.14.1-r200711
8.14.1-r2007118.14.1-r200712
rootio-curl
Root:Alpine:3.20
 before 8.14.1-r200711
8.14.1-r2007118.14.1-r200712
curl
Root:Alpine:3.21
 before 8.14.1-r30078
8.14.1-r300788.14.1-r200778.14.1-r300798.14.1-r3007108.14.1-r3007118.14.1-r300712
rootio-curl
Root:Alpine:3.21
 before 8.14.1-r30078
8.14.1-r300788.14.1-r200778.14.1-r300798.14.1-r3007108.14.1-r3007118.14.1-r300712
curl
Root:Alpine:3.22
 before 8.14.1-r400710
8.14.1-r4007108.14.1-r300778.14.1-r300788.14.1-r30079
rootio-curl
Root:Alpine:3.22
 before 8.14.1-r400710
8.14.1-r4007108.14.1-r300778.14.1-r300788.14.1-r30079
curl
Root:Debian:13
 before 8.14.1-2+deb13u7.aikido.24
8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25
rootio-curl
Root:Debian:13
 before 8.14.1-2+deb13u7.aikido.24
8.14.1-2+deb13u7.aikido.248.14.1-2+deb13u7.aikido.25
curl
SUSE:Linux Enterprise Installer Updates 15 SP4
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Installer Updates 15 SP5
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Micro 5.3
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Micro 5.4
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Micro 5.5
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 21 CVEs
 before 8.14.1-150400.5.98.1
8.14.1-150400.5.98.1
curl
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 31 CVEs
 before 8.22.0-150700.7.33.1
8.22.0-150700.7.33.1
curl
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 31 CVEs
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 31 CVEs
 before 8.22.0-150600.4.58.1
8.22.0-150600.4.58.1
curl
Ubuntu:26.10
 before 8.20.0-2ubuntu11, plus listed versions
8.18.0-1ubuntu28.20.0-2ubuntu18.20.0-2ubuntu38.20.0-2ubuntu10
8.20.0-2ubuntu11
curl
Ubuntu:26.04:LTS
 before 8.18.0-1ubuntu2.7, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.1
Show 4 moreShow less
8.18.0-1ubuntu2.28.18.0-1ubuntu2.38.18.0-1ubuntu2.48.18.0-1ubuntu2.5
8.18.0-1ubuntu2.7
curl
Ubuntu:Pro:16.04:LTS
From an advisory covering 8 CVEs
 before 7.47.0-1ubuntu2.19+esm20, plus listed versions
7.43.0-1ubuntu27.45.0-1ubuntu17.46.0-1ubuntu17.47.0-1ubuntu17.47.0-1ubuntu2
Show 34 moreShow less
7.47.0-1ubuntu2.17.47.0-1ubuntu2.27.47.0-1ubuntu2.37.47.0-1ubuntu2.47.47.0-1ubuntu2.57.47.0-1ubuntu2.67.47.0-1ubuntu2.77.47.0-1ubuntu2.87.47.0-1ubuntu2.97.47.0-1ubuntu2.117.47.0-1ubuntu2.127.47.0-1ubuntu2.137.47.0-1ubuntu2.147.47.0-1ubuntu2.157.47.0-1ubuntu2.167.47.0-1ubuntu2.187.47.0-1ubuntu2.197.47.0-1ubuntu2.19+esm17.47.0-1ubuntu2.19+esm27.47.0-1ubuntu2.19+esm37.47.0-1ubuntu2.19+esm47.47.0-1ubuntu2.19+esm57.47.0-1ubuntu2.19+esm67.47.0-1ubuntu2.19+esm77.47.0-1ubuntu2.19+esm87.47.0-1ubuntu2.19+esm97.47.0-1ubuntu2.19+esm107.47.0-1ubuntu2.19+esm117.47.0-1ubuntu2.19+esm127.47.0-1ubuntu2.19+esm137.47.0-1ubuntu2.19+esm157.47.0-1ubuntu2.19+esm167.47.0-1ubuntu2.19+esm177.47.0-1ubuntu2.19+esm18
7.47.0-1ubuntu2.19+esm20
curl
Ubuntu:Pro:18.04:LTS
From an advisory covering 8 CVEs
 before 7.58.0-2ubuntu3.24+esm14, plus listed versions
7.55.1-1ubuntu27.55.1-1ubuntu2.17.57.0-1ubuntu17.58.0-2ubuntu17.58.0-2ubuntu2
Show 34 moreShow less
7.58.0-2ubuntu37.58.0-2ubuntu3.17.58.0-2ubuntu3.27.58.0-2ubuntu3.37.58.0-2ubuntu3.57.58.0-2ubuntu3.67.58.0-2ubuntu3.77.58.0-2ubuntu3.87.58.0-2ubuntu3.97.58.0-2ubuntu3.107.58.0-2ubuntu3.127.58.0-2ubuntu3.137.58.0-2ubuntu3.147.58.0-2ubuntu3.157.58.0-2ubuntu3.167.58.0-2ubuntu3.177.58.0-2ubuntu3.187.58.0-2ubuntu3.197.58.0-2ubuntu3.207.58.0-2ubuntu3.217.58.0-2ubuntu3.227.58.0-2ubuntu3.237.58.0-2ubuntu3.247.58.0-2ubuntu3.24+esm17.58.0-2ubuntu3.24+esm27.58.0-2ubuntu3.24+esm37.58.0-2ubuntu3.24+esm47.58.0-2ubuntu3.24+esm57.58.0-2ubuntu3.24+esm77.58.0-2ubuntu3.24+esm87.58.0-2ubuntu3.24+esm97.58.0-2ubuntu3.24+esm107.58.0-2ubuntu3.24+esm117.58.0-2ubuntu3.24+esm12
7.58.0-2ubuntu3.24+esm14
curl
Ubuntu:Pro:20.04:LTS
From an advisory covering 8 CVEs
 before 7.68.0-1ubuntu2.25+esm9, plus listed versions
7.65.3-1ubuntu37.65.3-1ubuntu47.66.0-1ubuntu17.67.0-2ubuntu17.68.0-1ubuntu1
Show 28 moreShow less
7.68.0-1ubuntu27.68.0-1ubuntu2.17.68.0-1ubuntu2.27.68.0-1ubuntu2.47.68.0-1ubuntu2.57.68.0-1ubuntu2.67.68.0-1ubuntu2.77.68.0-1ubuntu2.107.68.0-1ubuntu2.117.68.0-1ubuntu2.127.68.0-1ubuntu2.137.68.0-1ubuntu2.147.68.0-1ubuntu2.157.68.0-1ubuntu2.167.68.0-1ubuntu2.187.68.0-1ubuntu2.197.68.0-1ubuntu2.207.68.0-1ubuntu2.217.68.0-1ubuntu2.227.68.0-1ubuntu2.237.68.0-1ubuntu2.247.68.0-1ubuntu2.257.68.0-1ubuntu2.25+esm27.68.0-1ubuntu2.25+esm37.68.0-1ubuntu2.25+esm47.68.0-1ubuntu2.25+esm57.68.0-1ubuntu2.25+esm67.68.0-1ubuntu2.25+esm7
7.68.0-1ubuntu2.25+esm9
curl
Ubuntu:22.04:LTS
From an advisory covering 8 CVEs
 before 7.81.0-1ubuntu1.29, plus listed versions
7.74.0-1.3ubuntu27.74.0-1.3ubuntu37.80.0-37.81.0-17.81.0-1ubuntu1.1
Show 23 moreShow less
7.81.0-1ubuntu1.27.81.0-1ubuntu1.37.81.0-1ubuntu1.47.81.0-1ubuntu1.67.81.0-1ubuntu1.77.81.0-1ubuntu1.87.81.0-1ubuntu1.107.81.0-1ubuntu1.117.81.0-1ubuntu1.137.81.0-1ubuntu1.147.81.0-1ubuntu1.157.81.0-1ubuntu1.167.81.0-1ubuntu1.177.81.0-1ubuntu1.187.81.0-1ubuntu1.197.81.0-1ubuntu1.207.81.0-1ubuntu1.217.81.0-1ubuntu1.227.81.0-1ubuntu1.237.81.0-1ubuntu1.247.81.0-1ubuntu1.257.81.0-1ubuntu1.267.81.0-1ubuntu1.27
7.81.0-1ubuntu1.29
curl
Ubuntu:24.04:LTS
From an advisory covering 8 CVEs
 before 8.5.0-2ubuntu10.15, plus listed versions
8.2.1-1ubuntu38.2.1-1ubuntu3.18.4.0-2ubuntu18.5.0-2ubuntu18.5.0-2ubuntu2
Show 16 moreShow less
8.5.0-2ubuntu88.5.0-2ubuntu98.5.0-2ubuntu108.5.0-2ubuntu10.18.5.0-2ubuntu10.28.5.0-2ubuntu10.38.5.0-2ubuntu10.48.5.0-2ubuntu10.58.5.0-2ubuntu10.68.5.0-2ubuntu10.78.5.0-2ubuntu10.88.5.0-2ubuntu10.98.5.0-2ubuntu10.108.5.0-2ubuntu10.118.5.0-2ubuntu10.128.5.0-2ubuntu10.13
8.5.0-2ubuntu10.15
curl
Ubuntu:26.04:LTS
From an advisory covering 8 CVEs
 before 8.18.0-1ubuntu2.7, plus listed versions
8.14.1-2ubuntu18.17.0-1ubuntu18.18.0-1ubuntu18.18.0-1ubuntu28.18.0-1ubuntu2.1
Show 4 moreShow less
8.18.0-1ubuntu2.28.18.0-1ubuntu2.38.18.0-1ubuntu2.48.18.0-1ubuntu2.5
8.18.0-1ubuntu2.7
curl
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 8.22.0-1.1
8.22.0-1.1

History

History
RecordedChangedSources
affectedOSV
affected, aliases, facts, referencesOSV
affectedOSV
affectedOSV
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-80255 is a high vulnerability (CVSS 7.5) in Curl, published September 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in curl 8.22.0-r0.

References

Show 142 moreShow less
This page doesn't list everything

Left out here: 56 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open