CVE-2026-6276 — stale custom cookie host causes cookie leak
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:…
Published: 2026-05-13 · CVSS: 7.5 · CVSS 3.1
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7