DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63481: CVE-2026-63481: Sensitive Information Exposure in Hurl [Cookies] Redirection

#security #cve #cybersecurity

CVE-2026-63481: Sensitive Information Exposure in Hurl [Cookies] Redirection

Vulnerability ID: CVE-2026-63481
CVSS Score: 6.9
Published: 2026-09-02

Hurl version 8.0.1 and earlier contains a sensitive information exposure vulnerability during cross-origin HTTP redirections. Cookies defined via a dedicated [Cookies] parser block are carried into the redirected request, whereas standard raw Cookie headers are correctly stripped. This allows attackers to capture session credentials by redirecting Hurl clients to untrusted external hosts.

TL;DR

Hurl failed to strip cookies defined in the custom [Cookies] block when following cross-origin redirects, leading to potential session hijacking.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-201
  • Attack Vector: Network (AV:N)
  • CVSS Score: 6.9 (Medium)
  • EPSS Score: 0.00467
  • Impact: Sensitive Information Disclosure
  • Exploit Status: PoC Available
  • KEV Status: Not Listed

Affected Systems

  • Hurl command-line testing tool (Orange-OpenSource/hurl)
  • hurl: <= 8.0.1 (Fixed in: 8.1.0)

Code Analysis

Commit: ed91c89

Fix cookies leak when redirecting to a different host

Exploit Details

  • Advisory Context: The advisory details the proof of concept redirect mechanism and the differences in cookie header stripping behavior.

Mitigation Strategies

  • Upgrade to Hurl version 8.1.0 or higher
  • Convert native [Cookies] parser blocks into standard raw Cookie headers
  • Disable automated redirect following by setting location: false

Remediation Steps:

  1. Scan container configurations and CI/CD environments to identify Hurl installations run on versions <= 8.0.1.
  2. Upgrade software dependencies to draw Hurl version 8.1.0 or higher from upstream distributions.
  3. Where legacy deployments cannot be updated immediately, update .hurl files to replace [Cookies] blocks with standard Cookie headers.
  4. Instruct development teams to avoid enabling the --location-trusted CLI flag when performing operations on unverified URLs.

References

Read the full report for CVE-2026-63481 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)