A Set-Cookie header that uses a tab instead of a space before the Secure attribute causes curl to drop the Secure flag when storing the cookie. As a result, a cookie that should be transmitted only over HTTPS may be sent over plaintext HTTP on subsequent requests, exposing session tokens and other sensitive data to potential eavesdroppers.

Vendors affected: curl, product: curl. No specific version information is available from the CNA; all versions of curl that use the default cookie handling are potentially impacted.

The CVSS score is not provided and EPSS is unavailable, so the quantitative severity is unknown. The vulnerability is not yet listed in CISA’s KEV catalog. Inference points to a local or network attacker capable of seeing or influencing traffic to a host that responds with the malformed Set-Cookie header. Once the client stores the cookie without the Secure flag, the attacker could capture subsequent HTTP traffic to the same host and potentially hijack the session or exfiltrate sensitive data.