Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-6276 Details

Description

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA: CISA-ADPCVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://hackerone.com/reports/3671818 CISA-ADPExploitIssue TrackingThird Party Advisory
https://curl.se/docs/CVE-2026-6276.html curlPatchVendor Advisory
https://curl.se/docs/CVE-2026-6276.json curlProduct
https://hackerone.com/reports/3671818 curlExploitIssue TrackingThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/29/13 CVEMailing ListThird Party Advisory

Weakness Enumeration

CWE-IDCWE NameSource
CWE-319Cleartext Transmission of Sensitive Information[email protected]
CWE-346Origin Validation Errorcurl

Affected Products

ProductVersions
haxx curl
>= 7.71.0, < 8.20.0

CPE

  • cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

9 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-6276
NVD Published Date:
May 13, 2026
NVD Last Modified:
Sep 15, 2026
Source:
curl
CVE-2026-6276 Details - Not Deferred