Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect can therefore receive authentication or session cookies that should remain scoped to the original host. Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This issue is reported as fixed in version 8.1.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version
    8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and
    Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies
    created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect
    can therefore receive authentication or session cookies that should remain scoped to the original host.
    Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This
    issue is reported as fixed in version 8.1.0. (CVE-2026-63481)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version     8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and     Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies     created from the dedicated [Cookies] section into the redirected request. An attacker-controlled redirect     can therefore receive authentication or session cookies that should remain scoped to the original host.
    Cookies supplied through a raw Cookie header are stripped and are not affected by this specific path. This     issue is reported as fixed in version 8.1.0. (CVE-2026-63481)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
477684	Chainguard: hurl: security update to 8.1.0-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
477684	Chainguard: hurl: security update to 8.1.0-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
338693	Linux Distros Unpatched Vulnerability : CVE-2026-63481	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-63481

medium

Tenable Plugins

medium

medium

medium