{"id":"CVE-2026-63481","aliases":["DEBIAN-CVE-2026-63481","EUVD-2026-63465","GHSA-7w2g-9mf9-324m","UBUNTU-CVE-2026-63481"],"status":"published","title":"Hurl: Cookies in Cookies section leak when redirecting to a different host","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00664,"percentile":0.52226,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-201"],"published":"2026-08-20T16:28:24Z","modified":"2026-11-01T10:30:17Z","affected":[{"source":"ghsa","ecosystem":"crates.io","package":"hurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-hurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1","6.1.1-1","6.1.1-2","7.1.0-1","7.1.0-2"]},{"source":"osv","ecosystem":"crates.io","package":"hurl","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"8.0.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.0-1","7.1.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1-1","6.1.1-2","7.1.0-1"]}],"products":[{"vendor":"orange-opensource","product":"hurl"}],"references":[{"url":"https://github.com/Orange-OpenSource/hurl/security/advisories/GHSA-7w2g-9mf9-324m","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/Orange-OpenSource/hurl/pull/5119","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Orange-OpenSource/hurl/commit/ed91c894c2cf11704422010554037e3ba70b446e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.1","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63481","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7w2g-9mf9-324m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63481.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63481","tags":["advisory"]},{"url":"https://github.com/Orange-OpenSource/hurl","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-63481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63481","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63481","title":"Hurl: Cookies in Cookies section leak when redirecting to a different host","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","status":"published","published":"2026-08-20T16:28:24.282Z","modified":"2026-08-21T21:47:24.233Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-63465","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","status":"published","published":"2026-08-20T16:28:24Z","modified":"2026-08-21T21:47:24Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:01:36.505605Z"}],"ghsa":[{"id":"GHSA-7w2g-9mf9-324m","title":"Hurl: Cookies in Cookies section leak when redirecting to a different host","description":"## The Bug\n\nHurl \u003c= 8.0.1 lets you define cookies two ways in a .hurl file:\n\n1. As a raw Cookie: header in the [Header]/headers area\n2. In a dedicated [Cookies] section (parsed into RequestSpec.cookies)\n\nWhen following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. \n\nHurl file that leaks cookies:\n\n```hurl\nGET http://localhost:8000/follow-redirect-basic-auth?change_host=true\n[Cookies]\nfruit: lemon\nHTTP 200\n```\n\nHurl file that doesn't leak cookie:\n\n```hurl\nGET http://localhost:8000/follow-redirect-basic-auth?change_host=true\nCookie: fruit=lemon\nHTTP 200\n```\n\n## Patch\n\nWith Hurl \u003c= 8.0.1, user can use `Cookie` header instead of the dedicated `[Cookies]` section.","status":"published","published":"2026-09-02T22:11:11Z","modified":"2026-09-02T22:11:13Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-63481","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","status":"published","published":"2026-08-20T17:19:15.037Z","modified":"2026-10-18T20:10:00.11Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T14:12:40.302911Z"}],"osv":[{"id":"CVE-2026-63481","title":"Hurl: Cookies in Cookies section leak when redirecting to a different host","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","status":"published","published":"2026-08-20T16:28:24.282Z","modified":"2026-11-01T10:30:17.744175275Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"DEBIAN-CVE-2026-63481","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","status":"published","published":"2026-08-20T17:19:15.037Z","modified":"2026-10-23T17:47:45.016241918Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"GHSA-7w2g-9mf9-324m","title":"Hurl: Cookies in Cookies section leak when redirecting to a different host","description":"## The Bug\n\nHurl \u003c= 8.0.1 lets you define cookies two ways in a .hurl file:\n\n1. As a raw Cookie: header in the [Header]/headers area\n2. In a dedicated [Cookies] section (parsed into RequestSpec.cookies)\n\nWhen following a redirect to a different host, Hurl correctly strips security-sensitive data (Authorization, Cookie header, and basic-auth user) to avoid leaking credentials cross-host — mirroring libcurl's default behavior. But it only stripped the cookie that came in as a header. Cookies declared in the [Cookies] section were carried over to the new host unchanged — a credential-leak bug. \n\nHurl file that leaks cookies:\n\n```hurl\nGET http://localhost:8000/follow-redirect-basic-auth?change_host=true\n[Cookies]\nfruit: lemon\nHTTP 200\n```\n\nHurl file that doesn't leak cookie:\n\n```hurl\nGET http://localhost:8000/follow-redirect-basic-auth?change_host=true\nCookie: fruit=lemon\nHTTP 200\n```\n\n## Patch\n\nWith Hurl \u003c= 8.0.1, user can use `Cookie` header instead of the dedicated `[Cookies]` section.","status":"published","published":"2026-09-02T22:11:11Z","modified":"2026-09-02T22:15:05.173902634Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-201"],"updated_at":"2026-11-02T15:46:41.349637Z"},{"id":"UBUNTU-CVE-2026-63481","description":"Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.","status":"published","published":"2026-08-20T17:19:00Z","modified":"2026-10-17T13:00:32.538169281Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:43.630667Z"}]}}