{“lastseen”:”2026-01-20T07:28:01″,”description”:”## Summary\\nWhen a custom hostname is specified, it is used for cookie matching if the cookie engine is also enabled for this transfer. This matching persists in cross-origin redirects despite that the originally supplied hostname is removed.\\n\\ncookiehost is set from a custom Host header:\\n`lib\/http.c http_set_aptr_host`\\n“`c\\nptr = Curl_checkheaders(data, STRCONST(\\”Host\\”));\\nif(ptr \\u0026\\u0026 (!data-\\u003estate.this_is_a_follow || curl_strequal(data-\\u003estate.first_host, conn-\\u003ehost.name))) {\\n \/* If we have a given custom Host: header, we extract the hostname in\\n order to possibly use it for cookie reasons later on. We only allow the\\n custom Host: header if this is NOT a redirect, as setting Host: in the\\n redirected request is being out on thin ice. Except if the hostname\\n is the same as the first one! *\/\\n char *cookiehost;\\n CURLcode result = copy_custom_value(ptr, \\u0026cookiehost);\\n…\\n\\taptr-\\u003ecookiehost = cookiehost;\\n}\\n“`\\n\\ncookiehost is used for both sending cookies and processing Set-Cookie:\\n`lib\/http.c http_header_s`\\n“`c\\nv = (data-\\u003ecookies \\u0026\\u0026 data-\\u003estate.cookie_engine) ? HD_VAL(hd, hdlen, \\”Set-Cookie:\\”) : NULL;\\n…\\n\/* If there is a custom-set Host: name, use it here, or else use\\n * real peer hostname. *\/\\nconst char *host = data-\\u003estate.aptr.cookiehost ?\\n data-\\u003estate.aptr.cookiehost : conn-\\u003ehost.name;\\n…\\nresult = Curl_cookie_add(data, data-\\u003ecookies, TRUE, FALSE, v, host,\\n data-\\u003estate.up.path, secure_context);\\n“`\\n\\n`lib\/http.c http_cookies`\\n“`c\\nconst char *host = data-\\u003estate.aptr.cookiehost ?\\n data-\\u003estate.aptr.cookiehost : data-\\u003econn-\\u003ehost.name;\\nCurl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);\\nresult = Curl_cookie_getlist(data, data-\\u003econn, \\u0026okay, host, \\u0026list);\\n“`\\n\\nSince cookiehost is not cleared on redirects this behaviour persists across cross-origin redirects.\\n\\nlibcurl documentation on CURLOPT_HTTPHEADER [1]:\\n“`\\nThe specified hostname is used for cookie matching if the cookie engine is also enabled for this transfer….\\n“`\\nBut contains no explicit warning that this also applies in cross-origin redirects.\\n\\n## Affected version\\nTested on curl 8.18.0\\n\\n## Reproduction\\n“`\\nuser@pc:~$ curl -v -L -c cookies.txt -H \\”Host: example.com\\” –resolve b.com:8001:127.0.0.1 –resolve a.com:8000:127.0.0.1 a.com:8000\\n* Added b.com:8001:127.0.0.1 to DNS cache\\n* Added a.com:8000:127.0.0.1 to DNS cache\\n* Hostname a.com was found in DNS cache\\n* Trying 127.0.0.1:8000…\\n* Established connection to a.com (127.0.0.1 port 8000) from 127.0.0.1 port 56874 \\n* using HTTP\/1.x\\n\\u003e GET \/ HTTP\/1.1\\n\\u003e Host: example.com\\n\\u003e User-Agent: curl\/8.18.0\\n\\u003e Accept: *\/*\\n\\u003e \\n* Request completely sent off\\n* HTTP 1.0, assume close after body\\n\\u003c HTTP\/1.0 302 Found\\n\\u003c Server: BaseHTTP\/0.6 Python\/3.12.3\\n\\u003c Date: Mon, 19 Jan 2026 12:35:05 GMT\\n\\u003c Location: http:\/\/b.com:8001\/\\n* Added cookie ccc=\\”secret\\” for domain example.com, path \/, expire 0\\n\\u003c Set-Cookie: ccc=secret; Path=\/\\n\\u003c Content-Length: 0\\n\\u003c \\n* shutting down connection #0\\n* Clear auth, redirects to port from 8000 to 8001\\n* Issue another request to this URL: ‘http:\/\/b.com:8001\/’\\n* Hostname b.com was found in DNS cache\\n* Trying 127.0.0.1:8001…\\n* Established connection to b.com (127.0.0.1 port 8001) from 127.0.0.1 port 43966 \\n* using HTTP\/1.x\\n\\u003e GET \/ HTTP\/1.0\\n\\u003e Host: b.com:8001\\n\\u003e User-Agent: curl\/8.18.0\\n\\u003e Accept: *\/*\\n\\u003e Cookie: ccc=secret\\n\\u003e \\n* Request completely sent off\\n* HTTP 1.0, assume close after body\\n\\u003c HTTP\/1.0 302 Found\\n\\u003c Server: BaseHTTP\/0.6 Python\/3.12.3\\n\\u003c Date: Mon, 19 Jan 2026 12:35:05 GMT\\n* Added cookie bbb=\\”test\\” for domain example.com, path \/, expire 0\\n\\u003c Set-Cookie: bbb=test; Path=\/\\n\\u003c Location: http:\/\/a.com:8000\/check\\n\\u003c Content-Length: 0\\n\\u003c \\n* shutting down connection #1\\n* Clear auth, redirects to port from 8001 to 8000\\n* Issue another request to this URL: ‘http:\/\/a.com:8000\/check’\\n* Hostname a.com was found in DNS cache\\n* Trying 127.0.0.1:8000…\\n* Established connection to a.com (127.0.0.1 port 8000) from 127.0.0.1 port 56882 \\n* using HTTP\/1.x\\n\\u003e GET \/check HTTP\/1.0\\n\\u003e Host: example.com\\n\\u003e User-Agent: curl\/8.18.0\\n\\u003e Accept: *\/*\\n\\u003e Cookie: bbb=test; ccc=secret\\n\\u003e \\n* Request completely sent off\\n* HTTP 1.0, assume close after body\\n\\u003c HTTP\/1.0 200 OK\\n\\u003c Server: BaseHTTP\/0.6 Python\/3.12.3\\n\\u003c Date: Mon, 19 Jan 2026 12:35:05 GMT\\n\\u003c Content-Length: 0\\n\\u003c \\n* shutting down connection #2\\n“`\\n\\n“`\\nuser@pc:~$ cat cookies.txt \\n# Netscape HTTP Cookie File\\n# https:\/\/curl.se\/docs\/http-cookies.html\\n# This file was generated by libcurl! Edit at your own risk.\\n\\nexample.com\\tFALSE\\t\/\\tFALSE\\t0\\tbbb\\ttest\\nexample.com\\tFALSE\\t\/\\tFALSE\\t0\\tccc\\tsecret\\n“`\\n\\n## References\\n[1] https:\/\/curl.se\/libcurl\/c\/CURLOPT_HTTPHEADER.html\\n\\n## Impact\\n\\ncross\u2011origin cookies leak and injection risk”,”published”:”2026-01-19T18:46:21″,”modified”:”2026-01-20T06:48:30″,”type”:”hackerone”,”title”:”curl: Cross\u2011origin cookies leak and injection risk when using a custom Host header”,”source”:””,”references”:””,”id”:”H1:3516878″,”bulletinFamily”:”bugbounty”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/hackerone.com\/reports\/3516878″,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-01-20T07:28:01″,”description”:”## Summary\\nWhen a custom hostname is specified, it is used for cookie matching if the cookie engine is also enabled for this transfer. This matching…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,117,13,33,7,11,5],"class_list":["post-36403","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-hackerone","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n