Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-29 | 1 | General1 |
| 2026-04-30 | 2 | Disclosure1General1 |
| 2026-05-02 | 1 | Disclosure1 |
| 2026-05-11 | 2 | Patch2 |
| 2026-07-13 | 1 | Patch1 |
kusanagi-curl モジュール更新情報 8.20.0-1 https://kusanagi.tokyo/releases/24476/ KUSANAGI 9 を構成している各モジュールのアップデートを行いました。 アップデートにより適用される各モジュールのバージョンは、以下のとおりとなります。 curl 8.20.0-1 この更新には脆弱性(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253, CVE-2026-5773, CVE-2026-5545, CVE-2...
Post summary
The kusanagi‑curl module update addresses multiple CVEs, but contains no exploit, PoC, or active exploitation detail.
curl CVE-2026-6253: proxy credentials leak over redirect-to proxy CVE-2026-7009: OCSP stapling bypass with Apple SecTrust CVE-2026-6276: stale custom cookie host causes cookie leak CVE-2026-7168: cross-proxy Digest auth state leak 2/2
Post summary
The post enumerates several CVE identifiers with concise descriptions of leaked information, presenting an initial disclosure of new vulnerabilities without any PoC, exploit, or patch details.
9 curl CVEs patched in Debian 13.6 🚨 🔵 CVE-2026-3783/6253 – token & credential leaks on redirects 🔵 CVE-2026-3805/5773 – SMB UAF & wrong reuse 🔵 CVE-2026-1965/5545 – Negotiate auth bypass 🔵 CVE-2026-3784 – proxy auth bypass (CVSS 6.5) 🔵 CVE-2026-6276 – cookie leak 🔵 CVE-2026-4873 – TLS bypass apt upgrade ⬆️
Post summary
Debian 13.6 has patched nine curl CVEs covering credential leaks, authentication bypasses, and other vulnerabilities; users are urged to run an apt upgrade.
kusanagi-curl Module Update 8.20.0-1 https://kusanagi.tokyo/en/releases/24477/ KUSANAGI 9 modules have been updated. The updated modules are as follows: curl 8.20.0-1 This update includes support for vulnerability(CVE-2026-7168, CVE-2026-7009, CVE-2026-6429, CVE-2026-6276, CVE-2026-6253,...
Post summary
The kusanagi-curl module 8.20.0-1 update patches several CVEs (CVE‑2026‑7168, CVE‑2026‑7009, CVE‑2026‑6429, CVE‑2026‑6276, CVE‑2026‑6253) without providing exploitation or PoC details.
⚡ CVE-2026-6276: stale custom cookie host causes cookie leak 👨🏻💻 arkss ➟ curl 🟨 Low 💰 None 🔗 https://hackerone.com/reports/3671818 #bugbounty #bugbountytips #cybersecurity #infosec https://t.co/bDioaYIIeH
Post summary
The tweet discloses CVE-2026-6276, a low‑severity cookie‑leak vulnerability caused by a stale custom cookie host, and links to a HackerOne report, but provides no PoC, exploit, or patch details.
curlで8件の脆弱性 CVE-2026-7168 CVE-2026-7009 CVE-2026-6429 CVE-2026-6276 CVE-2026-6253 CVE-2026-5773 CVE-2026-5545 CVE-2026-4873 Published vulnerabilities for curl/libcurl https://curl.se/docs/security.html
Post summary
The snippet enumerates eight curl/libcurl CVE identifiers and provides a link to the curl security page, offering no further detail about exploits, patches, or technical specifics.
CVE-2026-6276 [ADVISORY] curl https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6276 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet mentions CVE‑2026‑6276 related to curl and provides a link to an advisory and alert service, but offers no further vulnerability details or actionable information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | haxx | curl | - | - | - |