CVE-2026-6276

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

Affected products

Linuxmint, Red Os, Ubuntu, Curl, Libcurl

Haxx Curl

< 8.20.0

CVSS 3.1

7.5 HIGH

EPSS

0.3% (22th percentile)

Weakness

CWE-319

NVD status

Analyzed

Published

2026-05-13

No exploit for CVE-2026-6276 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.