The vulnerability in libcurl allows an attacker to gain access to cookies that belong to one host when a second host is contacted on the same reused TCP connection. The bug occurs when the first request supplies a custom Host header and subsequent requests on the same connection omit a Host header, causing libcurl to send the original host's cookies to the new host. This is an Origin Validation Error (CWE‑346) and can expose session data and other cookie‑based secrets.

Libcurl, the networking library used in many software products such as cURL, client tools, and embedded systems. No specific version information is available in the advisory, so any libcurl installation that has not applied a fix may be vulnerable.

The CVSS score is 3.7, indicating low overall severity. The EPSS score is not provided and the vulnerability is not listed in the CISA KEV catalog, implying limited commercial exploitation data. Exploitation generally requires debugging configurations to be present, making the attack vector somewhat constrained. However, the leak could still occur under normal use if connection reuse and custom Host headers are employed.