PatchSiren cyber security CVE debrief
CVE-2026-63481 Orange-OpenSource CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T17:19:15.037Z and has not been modified since then. The NVD entry is currently MEDIUM. This vulnerability affects Hurl, a command line tool for running and testing HTTP requests, specifically versions 8.0.1 and earlier. The issue lies in the redirect handling of Hurl, which strips certain headers like Authorization and Cookie but fails to properly handle cookies created from the [Cookies] section. This oversight allows an attacker-controlled redirect to potentially receive authentication or session cookies that should be scoped to the original host. To address this vulnerability, users should review and update Hurl to version 8.1.0 or later. Additionally, defenders should inventory Hurl installations to verify they are using a patched version, monitor for suspicious redirects in HTTP requests, and implement compensating controls such as additional authentication or session management measures. Reviewing Hurl configurations for proper cookie handling and verifying HTTP request testing tools and configurations for potential vulnerabilities are also crucial steps. Furthermore, tracking exceptions and retesting remediated assets will help ensure the vulnerability is fully mitigated.
- Vendor
- Orange-OpenSource
- Product
- hurl
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-20
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-20
- Advisory updated
- 2026-08-21
Who should care
Users of Hurl version 8.0.1 and earlier, developers and administrators working with HTTP requests and testing tools, security teams monitoring for potential cookie interception vulnerabilities, and operators of systems that use Hurl for testing HTTP requests.
Technical summary
Hurl, a command line tool for running and testing HTTP requests, has a vulnerability in version 8.0.1 and earlier. The redirect handling in Hurl strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. This allows an attacker-controlled redirect to potentially receive authentication or session cookies that should remain scoped to the original host. The vulnerability is fixed in version 8.1.0.
Defensive priority
Medium-severity vulnerability in Hurl, a command line tool for running and testing HTTP requests, allows attackers to potentially intercept authentication or session cookies through an attacker-controlled redirect.
Recommended defensive actions
- Review and update Hurl to version 8.1.0 or later
- Inventory Hurl installations and verify they are using a patched version
- Monitor for suspicious redirects in HTTP requests
- Implement compensating controls such as additional authentication or session management measures
- Review Hurl configurations for proper cookie handling
- Verify HTTP request testing tools and configurations for potential vulnerabilities
- Track exceptions and retest remediated assets
Evidence notes
The CVE record and NVD detail provide information on the vulnerability in Hurl version 8.0.1 and earlier. The issue involves redirect handling that strips certain headers but not cookies created from the [Cookies] section, potentially allowing an attacker-controlled redirect to receive authentication or session cookies. To verify, defenders should review Hurl configurations, monitor for suspicious redirects, and ensure proper cookie handling. Additional verification steps include reviewing HTTP request testing tools and configurations for potential vulnerabilities.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T17:19:15.037Z and has not been modified since then.