A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4954-1 advisory.

    - CVE-2026-8932: incomplete mTLS config matching in conn reuse (bsc#1268414).
    - CVE-2026-11856: cross-origin Digest auth state leak (bsc#1268426).
    - CVE-2026-18924: HTTP/2 server push UAF (bsc#1277477).
    - CVE-2026-19931: Negotiate ambient user conn reuse (bsc#1277478).
    - CVE-2026-80255: secure cookie attribute bypass with tab (bsc#1277482).
    - CVE-2026-82209: domain-scoped PSL domain cookie (bsc#1278173).
    - CVE-2026-86409: stale SigV4 headers sent unintended (bsc#1285031).
    - CVE-2026-86410: redirect to SFTP or SCP bypasses host verification (bsc#1285030).
    - CVE-2026-86414: leaking host credentials to HTTP proxy (bsc#1285026).
    - CVE-2026-87862: HSTS cache import drops longer-lived child (bsc#1285023).
    - CVE-2026-87863: HSTS response erases persisted entries (bsc#1285022).
    - CVE-2026-87864: IMAP APPEND plus CRLF conversion command injection (bsc#1285021).
    - CVE-2026-92386: server-set cookie aborts cookie jar load (bsc#1285018).
    - CVE-2026-92387: never-ending loop via server response omission (bsc#1285017).
    - CVE-2026-92388: FTP wildcard write callback mixup (bsc#1285016).
    - CVE-2026-92389: TFTP direction confusion (bsc#1285015).
    - CVE-2026-92390: -J no-clobber guarantee bypassed with 103 early hints (bsc#1285014).
    - CVE-2026-92391: curl_mime_free stack overflow by recursion (bsc#1285013).
    - CVE-2026-92392: HTTP/2 upload Use-After-Free (bsc#1285012).
    - CVE-2026-94266: password leak in CURLINFO_EFFECTIVE_URL (bsc#1285010).
    - CVE-2026-107929: local interface connection reuse mixup (bsc#1285008).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b60c369f26 advisory.

    - fix OpenLDAP SASL authentication bypass (CVE-2026-13608)
    - fix OpenSSL pinning bypass (CVE-2026-80230)

    ----

    - fix secure cookie attribute bypass with tab (CVE-2026-80255)
    - fix OpenSSL provider use-after-free (CVE-2026-80229)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-d65da12723 advisory.

    - fix incomplete mTLS config matching in conn reuse (CVE-2026-8932)
    - fix OpenLDAP SASL authentication bypass (CVE-2026-13608)
    - fix OpenSSL pinning bypass (CVE-2026-80230)

    ----

    - fix secure cookie attribute bypass with tab (CVE-2026-80255)
    - fix OpenSSL provider use-after-free (CVE-2026-80229)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32)
    immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The
    cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
    (CVE-2026-80255)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8efcd7a2a0 advisory.

    - fix secure cookie attribute bypass with tab (CVE-2026-80255)
    - fix OpenSSL provider use-after-free (CVE-2026-80229)

    ----

    - Fix HTTP/2 server push UAF (CVE-2026-18924)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8820-1 advisory.

    Eunsoo Kim discovered that curl incorrectly handled SASL negotiation for LDAP authentication in certain     circumstances. A machine-in-the-middle attacker could possibly use this issue to bypass peer validation.
    This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-13608)

    Stephan Zeisberg discovered that curl incorrectly handled HTTP/2 Server Push streams when sharing     connections between handles. A remote attacker could possibly use this issue to cause curl to crash,     resulting in a denial of service, or execute arbitrary code. (CVE-2026-18924)

    Stanislav Fort discovered that curl incorrectly managed the lifetime of pooled TLS connections when using     the multi interface. An attacker could possibly use this issue to cause curl to crash, resulting in a     denial of service, or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-80229)

    Stanislav Fort discovered that curl did not properly enforce public key pinning when certificate     verification was disabled in certain circumstances. A remote attacker could possibly use this issue to     bypass pinning checks and cause curl to accept connections that should have been rejected.
    (CVE-2026-80230)

    Stanislav Fort discovered that curl incorrectly handled the Secure attribute of cookies in certain     circumstances. A remote attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 26.04 LTS. (CVE-2026-80255)

    Stanislav Fort discovered that curl did not properly enforce Public Suffix List boundaries when handling     cookies in certain circumstances. A remote attacker could possibly use this issue to cause cookies to be     sent to unrelated domains, resulting in sensitive information being exposed. This issue only affected     Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS.
    (CVE-2026-82209)

    Ady Elouej discovered that curl did not clear proxy authentication state between requests when reusing a     handle with environment-variable proxy configuration. A remote attacker could possibly use this issue to     obtain sensitive credentials. This issue was previously fixed in USN-8487-1, but that fix was incomplete     for Ubuntu 16.04 LTS. (CVE-2026-8927)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32)     immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The     cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.
    (CVE-2026-80255)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375384	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2026:4954-1)	Nessus	SuSE Local Security Checks	Local	critical
375119	Photon OS 5.0: Curl PHSA-2026-5.0-92-1008	Nessus	PhotonOS Local Security Checks	Local	critical
375029	Photon OS 4.0: Curl PHSA-2026-4.0-1092	Nessus	PhotonOS Local Security Checks	Local	critical
375018	Photon OS 5.0: Curl PHSA-2026-5.0-90-1049	Nessus	PhotonOS Local Security Checks	Local	critical
375012	Photon OS 5.0: Curl PHSA-2026-5.0-91-1008	Nessus	PhotonOS Local Security Checks	Local	critical
374628	Fedora 45 : curl (2026-b60c369f26)	Nessus	Fedora Local Security Checks	Local	high
367726	Fedora 43 : curl (2026-d65da12723)	Nessus	Fedora Local Security Checks	Local	high
476134	Echo: curl: security update to 1:8.22.0-1+e1curl-8.17.0: security update to 8.17.0+e1	Tenable Cloud Security	Echo Local Security Checks	Local	high
476134	Echo: curl: security update to 1:8.22.0-1+e1curl-8.17.0: security update to 8.17.0+e1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
364105	Fedora 44 : curl (2026-8efcd7a2a0)	Nessus	Fedora Local Security Checks	Local	critical
350699	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : curl vulnerabilities (USN-8820-1)	Nessus	Ubuntu Local Security Checks	Local	critical
342410	Linux Distros Unpatched Vulnerability : CVE-2026-80255	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-80255

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high

critical

critical

high