Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-2jc6-hc33-hv48

Опубликовано: 13 мая 2026
Источник: github
Github: Не прошло ревью
CVSS3: 7.5

Описание

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

EPSS

Процентиль: 21%
0.00291
Низкий

7.5 High

CVSS3

Дефекты

CWE-319

Связанные уязвимости

CVSS3: 7.5
ubuntu
3 месяца назад

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

CVSS3: 3.7
redhat
3 месяца назад

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

CVSS3: 7.5
nvd
3 месяца назад

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

CVSS3: 7.5
msrc
3 месяца назад

stale custom cookie host causes cookie leak

CVSS3: 7.5
debian
3 месяца назад

Using libcurl, when a custom `Host:` header is first set for an HTTP r ...

EPSS

Процентиль: 21%
0.00291
Низкий

7.5 High

CVSS3

Дефекты

CWE-319