CVE-2026-6276 - Vulnerability Analysis

Overview

libcurl contains a cookie leakage vulnerability caused by reuse of an easy handle with a stale custom Host header, letting attackers receive cookies meant for a different host, exploit requires reuse of the same easy handle without resetting headers.

Severity & Score

Impact

Attackers can receive cookies intended for another host, leading to information disclosure.

Mitigation

Update to the latest version of libcurl that fixes cookie handling with reused easy handles.

References

• http://www.openwall.com/lists/oss-security/2026/04/29/13
• https://curl.se/docs/CVE-2026-6276.html
• https://curl.se/docs/CVE-2026-6276.json
• https://hackerone.com/reports/3671818

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner