curl 8.22 Fixes a Secure Cookie Attribute Parsing Bypass

The curl project published CVE-2026-80255 with curl 8.22.0 on September 2, 2026. A Set-Cookie header that placed a horizontal tab immediately before the Secure attribute could make affected curl versions store the cookie without its Secure flag. A later request to the same host over plaintext HTTP might then send that cookie.

The issue is rated low severity, but it matters for long-running proxy automation that persists cookie jars, follows redirects, changes routes, or mixes HTTP and HTTPS test endpoints.

Scope the issue accurately

The official advisory identifies curl 8.13.0 through 8.21.0 as affected and curl 8.22.0 as fixed. The command-line tool and libcurl applications can both be affected.

The trigger requires a tab, rather than a normal space, immediately before Secure. The risk emerges when the incorrectly stored cookie is later eligible for a plaintext HTTP request to the same host. This does not mean every cookie stored by curl loses its flag, and it does not mean proxies themselves remove it.

Why proxy workflows should care

Proxy-backed collection and verification systems often keep sessions across multiple requests. Their cookie stores may survive:

• an exit rotation;
• a retry on another gateway;
• a worker restart;
• an HTTPS-to-HTTP redirect;
• a diagnostic request to a plaintext endpoint;
• reuse by another task if jars are not partitioned.

The dangerous combination is parser weakness plus an available plaintext path. Eliminate both: upgrade the client and prevent sensitive sessions from reaching HTTP.

Inventory cookie and route boundaries

For each workload, record the curl or libcurl version, cookie engine, persistent jar use, redirect policy, allowed schemes, proxy and direct-fallback policy, cookie-store partition key, session lifetime, and whether tenants or targets share a worker.

Search effective runtime configuration, not only source code. Shell wrappers, environment variables, compatibility layers, and retry handlers can introduce HTTP routes that the main configuration does not show.

Immediate response

1. Upgrade affected deployments to curl 8.22.0 or a vendor build containing the fix.
2. Block plaintext HTTP for authenticated workloads unless explicitly required.
3. Disable automatic HTTPS-to-HTTP downgrade redirects.
4. Partition cookie jars by tenant, target, environment, and trust boundary.
5. Rotate sensitive sessions if affected clients may have processed untrusted cookie headers.
6. Drain old workers and remove obsolete persistent jars after rollout.
7. Run a controlled parser and downgrade regression test.

Do not attempt to repair unknown jars by editing their files in place. When exposure cannot be ruled out, invalidate the session and create a clean jar.

Build a controlled regression test

Use a host and response service you control. Create cases for normal spacing before Secure, a horizontal tab before Secure, multiple surrounding attributes, mixed casing, an HTTPS response followed by an authorized HTTP request to the same test host, a downgrade redirect, and a second tenant that must not see the first jar.

After each response, inspect sanitized cookie metadata or controlled server observations. Never place real account cookies in the fixture.

Expected results:

• cookies marked Secure remain unavailable to plaintext HTTP;
• downgrade redirects are rejected by policy;
• separate partitions cannot read each other's sessions;
• curl 8.22.0 behaves consistently for normal-space and tab cases;
• no direct fallback bypasses the approved proxy route.

Test the whole lifecycle

Repeat the test across a fresh process, a reused easy handle, a persisted jar loaded by a new process, a proxy exit rotation, a bounded retry, a worker handoff, and session invalidation.

This exposes cases where a correctly upgraded parser still consumes an unsafe jar produced earlier.

Collect evidence without secrets

Record the test case ID, UTC timestamp, curl version, URL scheme, normalized host and proxy-route labels, redirect decision, cookie name represented by a case-local hash, Secure flag state, jar partition ID, plaintext attempt or block decision, and final result.

Do not log cookie values, authentication headers, full URLs with query strings, proxy credentials, or user data. Use Proxy Support Escalation Packet if vendor investigation is required.

Fail closed on downgrade

• Permit only HTTPS for authenticated sessions.
• Treat HTTPS-to-HTTP redirects as policy failures.
• Do not retry a cookie-bearing request over HTTP.
• Do not switch to direct access after a proxy or TLS error.
• Do not merge cookie jars when rotating exits.
• Keep deterministic policy errors out of the generic retry pool.

Use Proxy Bypass Audit to identify unintended direct routes and Proxy Retry Budget to prevent retries from amplifying exposure.

Rollout checklist

• All curl and libcurl versions are inventoried.
• Affected builds are upgraded or vendor-patched.
• Authenticated workflows allow HTTPS only.
• Downgrade redirects are blocked.
• Cookie jars are partitioned by trust boundary.
• Old workers and jars are drained safely.
• Normal-space and tab parsing tests pass.
• Secure cookies never reach the controlled HTTP endpoint.
• Retry and fallback paths preserve scheme policy.
• Logs contain metadata only, never cookie values.
• Session invalidation has been tested.
• Monitoring separates redirect, TLS, proxy, and application errors.

FAQ

Does rotating the proxy make a cookie safe?

No. A cookie's transport policy is independent of the exit IP. Rotation does not restore a missing Secure flag.

Should all existing cookie jars be deleted?

Use a risk-based decision. If an affected client processed untrusted cookie headers and plaintext access was possible, invalidate the session and replace the jar. Preserve only sanitized evidence.

Can an HTTPS proxy protect an HTTP destination request?

It protects the client-to-proxy hop, not the application semantics of sending a cookie to an HTTP destination. Sensitive cookies must remain restricted to HTTPS destinations.

What is the preferred fix?

Upgrade to curl 8.22.0 or a supported vendor package containing the fix, and keep plaintext downgrade paths disabled.

Source note and compliance

Source: curl project, “secure cookie attribute bypass with tab,” CVE-2026-80255, published September 2, 2026. The external source address is retained only in the internal operations record.

Test only systems, sessions, and endpoints you are authorized to control. Respect privacy requirements, contracts, access controls, retention limits, and applicable law. Never use another party's session cookie or weaken transport security to obtain access.