A Set-Cookie header that uses a tab instead of a space before the Secure attribute causes curl to drop the Secure flag when storing the cookie. As a result, a cookie that should be transmitted only over HTTPS may be sent over plaintext HTTP on subsequent requests, exposing session tokens and other sensitive data to potential eavesdroppers.

Vendors affected: curl, product: curl. No specific version information is available from the CNA; all versions of curl that use the default cookie handling are potentially impacted.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score of < 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. An attacker capable of influencing or observing traffic to a host that sends the malformed Set‑Cookie header could cause the client to drop the Secure flag, leading to the cookie being transmitted over plaintext HTTP on subsequent requests. This could allow session hijack or exfiltration of sensitive data.