PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63481 Orange-OpenSource CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T17:19:15.037Z and has not been modified since then. The NVD entry is currently MEDIUM. This vulnerability affects Hurl, a command line tool for running and testing HTTP requests, specifically versions 8.0.1 and earlier. The issue lies in the redirect handling of Hurl, which strips certain headers like Authorization and Cookie but fails to properly handle cookies created from the [Cookies] section. This oversight allows an attacker-controlled redirect to potentially receive authentication or session cookies that should be scoped to the original host. To address this vulnerability, users should review and update Hurl to version 8.1.0 or later. Additionally, defenders should inventory Hurl installations to verify they are using a patched version, monitor for suspicious redirects in HTTP requests, and implement compensating controls such as additional authentication or session management measures. Reviewing Hurl configurations for proper cookie handling and verifying HTTP request testing tools and configurations for potential vulnerabilities are also crucial steps. Furthermore, tracking exceptions and retesting remediated assets will help ensure the vulnerability is fully mitigated.

Vendor
Orange-OpenSource
Product
hurl
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-20
Original CVE updated
2026-09-18
Advisory published
2026-08-20
Advisory updated
2026-09-18

Who should care

Users of Hurl version 8.0.1 and earlier, developers and administrators working with HTTP requests and testing tools, security teams monitoring for potential cookie interception vulnerabilities, and operators of systems that use Hurl for testing HTTP requests.

Technical summary

Hurl, a command line tool for running and testing HTTP requests, has a vulnerability in version 8.0.1 and earlier. The redirect handling in Hurl strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but it carries RequestSpec.cookies created from the dedicated [Cookies] section into the redirected request. This allows an attacker-controlled redirect to potentially receive authentication or session cookies that should remain scoped to the original host. The vulnerability is fixed in version 8.1.0.

Defensive priority

Medium-severity vulnerability in Hurl, a command line tool for running and testing HTTP requests, allows attackers to potentially intercept authentication or session cookies through an attacker-controlled redirect.

Recommended defensive actions

  • Review and update Hurl to version 8.1.0 or later
  • Inventory Hurl installations and verify they are using a patched version
  • Monitor for suspicious redirects in HTTP requests
  • Implement compensating controls such as additional authentication or session management measures
  • Review Hurl configurations for proper cookie handling
  • Verify HTTP request testing tools and configurations for potential vulnerabilities
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD detail provide information on the vulnerability in Hurl version 8.0.1 and earlier. The issue involves redirect handling that strips certain headers but not cookies created from the [Cookies] section, potentially allowing an attacker-controlled redirect to receive authentication or session cookies. To verify, defenders should review Hurl configurations, monitor for suspicious redirects, and ensure proper cookie handling. Additional verification steps include reviewing HTTP request testing tools and configurations for potential vulnerabilities.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-63481 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-63481

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-63481 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-63481

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.