Search
Search is not available in local development.
Run npx pagefind --site __site after building to enable it.
JLSEC-2026-1207 High 7.5

Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request...

JLSEC Published
Modified
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Packages
CURL_jll < 8.20.0+0
LibCURL_jll >= 7.71.1+0, < 8.20.0+0

Using libcurl, when a custom Host: header is first set for an HTTP request and a second request is subsequently done using the same easy handle but without the custom Host: header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.

References