Examples / Report #3972395 Saved analysis

CVE-2026-80255: secure cookie attribute bypass with tab

curl · 2026-08-2615.3s analysis · $0.021 in model calls

What the report claims

A Set-Cookie header using HTAB before the Secure attribute causes curl to store the cookie without its Secure flag, leading to plaintext transmission of the cookie over subsequent HTTP requests.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2026-80255 secure cookie attribute bypass with tab

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Code supports the claim

The code supports the reported flaw. A maintainer should review its impact and decide what to do next.

Why this finding?

The provided code at lib/cookie.c:610-656 shows a do/while loop that consumes ';' but does not skip blank characters (space or HTAB) before parsing the next attribute name.
curlx_str_cspn at line 614 rejects HTAB in its reject set, so a leading HTAB causes the attribute parse to fail silently.
The Secure flag parsing (parse_flag at line 642) is inside the skipped if block, so the cookie is stored without the Secure flag.
The cookie is then sent over plaintext HTTP, violating the confidentiality boundary the Secure attribute establishes.
The fix is straightforward: add curlx_str_passblanks(&ptr) after the ';' is consumed.
The external RFC 6265 claim about HTAB as valid whitespace is not explicitly confirmed by the provided excerpt, but curl's own ISBLANK macro treats HTAB as blank, indicating the project considers it valid whitespace.

How this analysis ran 5 claims · 15 citations verified

Checked against curl tested commit c2676bf9e639 (c2676bf9e639). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding

grounded

no model · 14 references checked out, 0 did not

2 · Claims

NVIDIA-Nemotron-3-Nano-30B-A3B

5 claims · 2337 tokens · $0.0003

3 · Evidence

6 code snippets

real curl source at c2676bf9e639 · 6 docs via Tavily

4 · Judgment

Nemotron-3-Ultra-550b-a55b

15029 tokens · 13.2s · $0.0211

5 · Receipts

15 of 15 citations verified

every citation must point at code the judge was shown

Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report. The code confirms the flaw: parse_cookie_header() in lib/cookie.c does not skip HTAB after consuming ';', causing attributes starting with HTAB to be silently dropped. The Secure flag is lost and the cookie leaks over HTTP. We will add curlx_str_passblanks() after the ';' consumption and a regression test. The fix is targeted for the next release.

Inspect all claims and source code 5 claims · 6 code excerpts

Report claims

C1flaw supported

parse_cookie_header() fails to parse attributes that start with HTAB, causing the Secure flag to be silently dropped

Read the reasoning

The do/while loop at lines 610-656 parses each attribute. After consuming ';', if the next character is HTAB, curlx_str_cspn at line 614 returns failure (STRE_SHORT) because HTAB is in its reject set. The if block (lines 615-655) containing parse_flag for 'secure' is skipped. Then curlx_str_single at line 656 fails to match ';', exiting the loop. The cookie is stored at lines 658-662 without the Secure flag.

lib/cookie.c:614 lib/cookie.c:642 lib/cookie.c:656 lib/cookie.c:658

C2location supported

In lib/cookie.c, parse_cookie_header() uses a do/while loop that does not skip HTAB after consuming ';'

Read the reasoning

The loop at lines 610-656 has no call to curlx_str_passblanks or equivalent blank-skipping after consuming ';' at line 656 and before the next curlx_str_cspn at line 614. The helper curlx_str_passblanks exists (strparse.c:313-317) and uses ISBLANK which includes HTAB (curl_ctype.h:43), but it is not invoked here.

lib/cookie.c:610 lib/cookie.c:656 lib/curlx/strparse.c:313 lib/curl_ctype.h:43

C3trigger supported

A Set-Cookie header containing a literal HTAB (0x09) before the Secure attribute, e.g. 'Set-Cookie: sid=SECRET;\tSecure'

Read the reasoning

A Set-Cookie header like 'sid=SECRET;\tSecure' leaves ptr at HTAB after the ';' is consumed. The next curlx_str_cspn call sees HTAB as the first character, which is in its reject set, so it returns failure and the attribute 'Secure' is never parsed.

lib/cookie.c:614 lib/curlx/strparse.c:290

C4impact supported

The cookie is stored without the Secure flag and is subsequently sent over plaintext HTTP on follow‑up requests to the same host

Read the reasoning

Since the Secure attribute is never parsed (parse_flag not called), the cookie is stored without the Secure flag. Per curl's cookie storage model, cookies without the Secure flag are sent over both HTTPS and HTTP, causing the secret to leak on plaintext connections.

lib/cookie.c:642 lib/cookie.c:658 lib/cookie.c:660

C5reproduction supported

Steps 1‑8 in the report reproduce the bug by requesting /htab, saving the cookie jar, and then making an HTTP request that echoes the cookie

Read the reasoning

The reproduction steps exercise the exact code path: HTTPS request sets cookie with HTAB before Secure, cookie jar saves it without Secure flag, subsequent HTTP request sends the cookie. The provided code confirms this path exists.

lib/cookie.c:587 lib/cookie.c:660

What the report says about other projects

not addressed HTAB is valid optional whitespace per RFC 6265 section 5.2 and the HTTP grammar (OWS)

Read the original report (excerpt)

Full report on HackerOne ↗

## Summary A `Set-Cookie` header using HTAB (horizontal tab) instead of SPACE before the `Secure` attribute — e.g. `Set-Cookie: sid=SECRET;\tSecure` — causes curl to store the cookie without its Secure flag. The cookie is then sent over plaintext HTTP on subsequent requests to the same host. The space-separated form `Set-Cookie: sid=SECRET; Secure` works correctly. ## Affected versions curl 8.13.0 through at least 8.21.0 (all versions containing commit `1aea05a6c26`, "cookie: convert to using strparse", 2025-02-18). ## Root cause In `lib/cookie.c`, `parse_cookie_header()` uses a do/while loop that parses each cookie attribute: ```c do { if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) { // parse attribute } } while(!curlx_str_single(&ptr, ';')); ``` After consuming the `;` separator, `ptr` points at the HTAB. Since `\t` is in the reject set of `curlx_str_cspn`, the function sees it as the first character, returns an empty match (failure), and the `if` block is skipped. Then `curlx_str_single(&ptr, ';')` fails because the current byte is `\t`, not `;`, so the loop exits. The `Secure` attribute is never parsed, but the cookie is still stored. The previous parser (before `1aea05a6c26`) had `while(ISBLANK(*ptr)) ptr++;` before parsing each attribute, which correctly skipped HTAB. This blank-skipping was lost in the strparse conversion. The helper `curlx_str_passblanks()` exists in the codebase but is not called here. ## Reproduction 1. Build curl at commit c2676bf9e639e31e44b12a2cc82cf2046231b056 (or any version from 8.13.0 onward) with OpenSSL support enabled. 2. Generate a self-signed TLS certificate for the hostname test.invalid, valid for at least one day. 3. Start a local server that listens on two ports: HTTPS on port 8443 — serves Set-Cookie: sid=HTAB_SECRET;\tSecure (with a literal HTAB character 0x09 before Secure) when the path is /htab, and Set-Cookie: sid=SPACE_SECRET; Secure (with a normal space) when the path is /space. HTTP on port 8080 — echoes back the received Cookie header value in the response body. 4. Set the HTAB cookie over HTTPS by requesting https://test.invalid:8443/htab, saving the cookie jar: ``` curl -ks --noproxy '*' \ --resolve test.invalid:8443:127.0.0.1 \ -c /tmp/htab.jar \ https://test.invalid:8443/htab Make a follow-up request over plaintext HTTP using the saved cookie jar: ``` ``` curl -sS --nop …

Source code

lib/curlx/strparse.clines 283–299 · definition of curlx_str_cspn

            
              
                283int curlx_str_cspn(const char **linep, struct Curl_str *out,
                 const char *reject)
285{
const char *s = *linep;
size_t len;
DEBUGASSERT(linep && *linep);
289
len = strcspn(s, reject);
C3: strcspn returns 0 length when first character is in reject set, causing STRE_SHORT
if(len) {
  out->str = s;
  out->len = len;
  *linep = &s[len];
  return STRE_OK;
}
curlx_str_init(out);
return STRE_SHORT;
299}

          

lib/curl_ctype.hlines 43–43 · definition of ISBLANK

            
                43#define ISBLANK(x)  (((x) == ' ') || ((x) == '\t'))
C2: ISBLANK macro defines blank as space or HTAB

lib/curlx/strparse.clines 313–317 · definition of curlx_str_passblanks

            
              
                313void curlx_str_passblanks(const char **linep)
C2: curlx_str_passblanks exists and skips ISBLANK (space or HTAB) but is not called in parse_cookie_header
314{
315  while(ISBLANK(**linep))
316    (*linep)++; /* move over it */
317}

          

lib/cookie.clines 587–665 · definition of parse_cookie_header

            
              
                587static CURLcode
C5: parse_cookie_header is the entry point for Set-Cookie header parsing
588parse_cookie_header(struct Curl_easy *data,
                  struct Cookie *co,
                  const struct CookieInfo *ci,
                  bool *okay, /* if the cookie was fine */
                  const char *ptr, /* the header */
                  const char *domain, /* default domain */
                  /* full path used when this cookie is set */
                  const char *path,
                  bool secure_origin)
597{
/* This line was read off an HTTP-header */
time_t now = 0;
size_t linelength = strlen(ptr);
CURLcode result = CURLE_OK;
struct Curl_str cookie[COOKIE_PIECES];
*okay = FALSE;
if(linelength > MAX_COOKIE_LINE)
  /* discard overly long lines at once */
  return CURLE_OK;
607
/* memset instead of initializer because gcc 4.8.1 is silly */
memset(cookie, 0, sizeof(cookie));
do {
C2: do/while loop starts here with no blank-skipping before curlx_str_cspn
  struct Curl_str name;
612
  /* we have a <name>=<value> pair or a stand-alone word here */
  if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
C1: curlx_str_cspn rejects HTAB in its reject set ";\t\r\n=", so an attribute starting with HTAB fails to parse
C3: curlx_str_cspn called with reject set including HTAB; a leading HTAB causes immediate failure
    struct Curl_str val;
    bool sep = FALSE;
    curlx_str_trimblanks(&name);
618
    if(invalid_octets(curlx_str(&name), curlx_strlen(&name))) {
      infof(data, "invalid octets in name, cookie dropped");
      return CURLE_OK;
    }
623
    if(!curlx_str_single(&ptr, '=')) {
      sep = TRUE; /* a '=' was used */
      if(!curlx_str_cspn(&ptr, &val, ";\r\n"))
        curlx_str_trimblanks(&val);
628
      if(invalid_octets(curlx_str(&val), curlx_strlen(&val))) {
        infof(data, "invalid octets in value, cookie dropped");
        return CURLE_OK;
      }
    }
    else
      curlx_str_init(&val);
636
    if(!curlx_strlen(&cookie[COOKIE_NAME])) {
      if(!parse_first_pair(data, co, cookie, &name, &val, sep))
        return CURLE_OK;
    }
    else if(!sep) {
      if(!parse_flag(data, co, ci, &name, secure_origin))
C1: parse_flag for Secure attribute is inside the if block that is skipped when curlx_str_cspn fails
C4: parse_flag for 'secure' is only called inside the if block that is skipped
        return CURLE_OK;
    }
    else if(curlx_str_casecompare(&name, "path"))
      cookie[COOKIE_PATH] = val;
    else if(curlx_str_casecompare(&name, "domain") && curlx_strlen(&val)) {
      if(!parse_domain(data, co, &cookie[COOKIE_DOMAIN], &val, &domain))
        return CURLE_OK;
    }
    else if(curlx_str_casecompare(&name, "max-age") && curlx_strlen(&val))
      parse_maxage(co, &val, &now);
    else if(curlx_str_casecompare(&name, "expires") && curlx_strlen(&val))
      parse_expires(co, &val, &now);
  }
} while(!curlx_str_single(&ptr, ';'));
C1: curlx_str_single(&ptr, ';') fails because current byte is HTAB, not ';', causing loop exit
C2: Loop condition consumes ';' but does not skip blanks before next iteration
657
if(curlx_strlen(&cookie[COOKIE_NAME])) {
C1: Cookie is still stored via storecookie() even though Secure flag was never parsed
C4: Cookie is stored if COOKIE_NAME has length, regardless of whether Secure flag was parsed
  /* the header was fine, now store the data */
  result = storecookie(co, &cookie[0], path, domain);
C4: storecookie called with cookie data that lacks Secure flag
C5: storecookie persists the cookie to the cookie jar
  if(!result)
    *okay = TRUE;
}
return result;
665}

          

lib/curlx/strparse.clines 138–145 · definition of curlx_str_single

Show 8 lines (not cited by the judge)

              138int curlx_str_single(const char **linep, char byte)
139{
140  DEBUGASSERT(linep && *linep);
141  if(**linep != byte)
142    return STRE_BYTE;
143  (*linep)++; /* move over it */
144  return STRE_OK;
145}

lib/optiontable.pllines 84–125 · definition of while

Show 42 lines (not cited by the judge)

              84while(<CURL_H>) {
  my $l = $_;
  if($fl) {
      # continued deprecation
      if($l =~ /(.*)\),/) {
          $fl .= $1;
90
          # the end
          my @p = split(/, */, $fl);
          add($p[0], $p[1], $p[2]);
          undef $fl;
      }
      else {
          # another line to append
          chomp $l;
          $fl .= $l;
      }
  }
102
  if(/^ *CURLOPTDEPRECATED\((.*)/) {
      $fl = $1;
      chomp $fl;
  }
107
  if(/^ *CURLOPT\(([^,]*), ([^,]*), (\d+)\)/) {
      my($opt, $type, $num) = ($1, $2, $3);
      add($opt, $type, $num);
  }
112
  # alias for an older option
  # old = new
  if(/^#define (CURLOPT_[^ ]*) *(CURLOPT_\S*)/) {
      my ($o, $n) = ($1, $2);
      # skip obsolete ones
      if(($n !~ /OBSOLETE/) && ($o !~ /OBSOLETE/)) {
          $o =~ s/^CURLOPT_//;
          $n =~ s/^CURLOPT_//;
          $alias{$o} = $n;
          push @names, $o;
      }
  }
125}

283	int curlx_str_cspn(const char *linep, struct Curl_str out,
284	const char *reject)
285	{
286	const char s = linep;
287	size_t len;
288	DEBUGASSERT(linep && *linep);
289
290	len = strcspn(s, reject);
	C3: strcspn returns 0 length when first character is in reject set, causing STRE_SHORT
291	if(len) {
292	out->str = s;
293	out->len = len;
294	*linep = &s[len];
295	return STRE_OK;
296	}
297	curlx_str_init(out);
298	return STRE_SHORT;
299	}

43	#define ISBLANK(x) (((x) == ' ') \|\| ((x) == '\t'))
	C2: ISBLANK macro defines blank as space or HTAB

313	void curlx_str_passblanks(const char **linep)
	C2: curlx_str_passblanks exists and skips ISBLANK (space or HTAB) but is not called in parse_cookie_header
314	{
315	while(ISBLANK(**linep))
316	(linep)++; / move over it */
317	}

587	static CURLcode
	C5: parse_cookie_header is the entry point for Set-Cookie header parsing
588	parse_cookie_header(struct Curl_easy *data,
589	struct Cookie *co,
590	const struct CookieInfo *ci,
591	bool okay, / if the cookie was fine */
592	const char ptr, / the header */
593	const char domain, / default domain */
594	/* full path used when this cookie is set */
595	const char *path,
596	bool secure_origin)
597	{
598	/* This line was read off an HTTP-header */
599	time_t now = 0;
600	size_t linelength = strlen(ptr);
601	CURLcode result = CURLE_OK;
602	struct Curl_str cookie[COOKIE_PIECES];
603	*okay = FALSE;
604	if(linelength > MAX_COOKIE_LINE)
605	/* discard overly long lines at once */
606	return CURLE_OK;
607
608	/* memset instead of initializer because gcc 4.8.1 is silly */
609	memset(cookie, 0, sizeof(cookie));
610	do {
	C2: do/while loop starts here with no blank-skipping before curlx_str_cspn
611	struct Curl_str name;
612
613	/* we have a <name>=<value> pair or a stand-alone word here */
614	if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
	C1: curlx_str_cspn rejects HTAB in its reject set ";\t\r\n=", so an attribute starting with HTAB fails to parse
	C3: curlx_str_cspn called with reject set including HTAB; a leading HTAB causes immediate failure
615	struct Curl_str val;
616	bool sep = FALSE;
617	curlx_str_trimblanks(&name);
618
619	if(invalid_octets(curlx_str(&name), curlx_strlen(&name))) {
620	infof(data, "invalid octets in name, cookie dropped");
621	return CURLE_OK;
622	}
623
624	if(!curlx_str_single(&ptr, '=')) {
625	sep = TRUE; /* a '=' was used */
626	if(!curlx_str_cspn(&ptr, &val, ";\r\n"))
627	curlx_str_trimblanks(&val);
628
629	if(invalid_octets(curlx_str(&val), curlx_strlen(&val))) {
630	infof(data, "invalid octets in value, cookie dropped");
631	return CURLE_OK;
632	}
633	}
634	else
635	curlx_str_init(&val);
636
637	if(!curlx_strlen(&cookie[COOKIE_NAME])) {
638	if(!parse_first_pair(data, co, cookie, &name, &val, sep))
639	return CURLE_OK;
640	}
641	else if(!sep) {
642	if(!parse_flag(data, co, ci, &name, secure_origin))
	C1: parse_flag for Secure attribute is inside the if block that is skipped when curlx_str_cspn fails
	C4: parse_flag for 'secure' is only called inside the if block that is skipped
643	return CURLE_OK;
644	}
645	else if(curlx_str_casecompare(&name, "path"))
646	cookie[COOKIE_PATH] = val;
647	else if(curlx_str_casecompare(&name, "domain") && curlx_strlen(&val)) {
648	if(!parse_domain(data, co, &cookie[COOKIE_DOMAIN], &val, &domain))
649	return CURLE_OK;
650	}
651	else if(curlx_str_casecompare(&name, "max-age") && curlx_strlen(&val))
652	parse_maxage(co, &val, &now);
653	else if(curlx_str_casecompare(&name, "expires") && curlx_strlen(&val))
654	parse_expires(co, &val, &now);
655	}
656	} while(!curlx_str_single(&ptr, ';'));
	C1: curlx_str_single(&ptr, ';') fails because current byte is HTAB, not ';', causing loop exit
	C2: Loop condition consumes ';' but does not skip blanks before next iteration
657
658	if(curlx_strlen(&cookie[COOKIE_NAME])) {
	C1: Cookie is still stored via storecookie() even though Secure flag was never parsed
	C4: Cookie is stored if COOKIE_NAME has length, regardless of whether Secure flag was parsed
659	/* the header was fine, now store the data */
660	result = storecookie(co, &cookie[0], path, domain);
	C4: storecookie called with cookie data that lacks Secure flag
	C5: storecookie persists the cookie to the cookie jar
661	if(!result)
662	*okay = TRUE;
663	}
664	return result;
665	}

138	int curlx_str_single(const char **linep, char byte)
139	{
140	DEBUGASSERT(linep && *linep);
141	if(**linep != byte)
142	return STRE_BYTE;
143	(linep)++; / move over it */
144	return STRE_OK;
145	}

84	while(<CURL_H>) {
85	my $l = $_;
86	if($fl) {
87	# continued deprecation
88	if($l =~ /(.*)\),/) {
89	$fl .= $1;
90
91	# the end
92	my @p = split(/, */, $fl);
93	add($p[0], $p[1], $p[2]);
94	undef $fl;
95	}
96	else {
97	# another line to append
98	chomp $l;
99	$fl .= $l;
100	}
101	}
102
103	if(/^ CURLOPTDEPRECATED\((.)/) {
104	$fl = $1;
105	chomp $fl;
106	}
107
108	if(/^ CURLOPT\(([^,]), ([^,]*), (\d+)\)/) {
109	my($opt, $type, $num) = ($1, $2, $3);
110	add($opt, $type, $num);
111	}
112
113	# alias for an older option
114	# old = new
115	if(/^#define (CURLOPT_[^ ]) (CURLOPT_\S*)/) {
116	my ($o, $n) = ($1, $2);
117	# skip obsolete ones
118	if(($n !~ /OBSOLETE/) && ($o !~ /OBSOLETE/)) {
119	$o =~ s/^CURLOPT_//;
120	$n =~ s/^CURLOPT_//;
121	$alias{$o} = $n;
122	push @names, $o;
123	}
124	}
125	}