GHSA-2jc6-hc33-hv48HighCVSS 7.5

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request...

Published
May 13, 2026
Last Modified
September 15, 2026

🔗 CVE IDs covered (1)

📋 Description

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

🔗 References (6)