{"uuid": "989b3457-783b-4c8d-b6d5-56060732206e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63481", "type": "seen", "source": "https://gist.github.com/alon710/51de9c39add9ed5552c3d2ae7ebb5a97", "content": "# CVE-2026-63481: CVE-2026-63481: Sensitive Information Exposure in Hurl [Cookies] Redirection\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63481\n\n## Summary\nHurl version 8.0.1 and earlier contains a sensitive information exposure vulnerability during cross-origin HTTP redirections. Cookies defined via a dedicated [Cookies] parser block are carried into the redirected request, whereas standard raw Cookie headers are correctly stripped. This allows attackers to capture session credentials by redirecting Hurl clients to untrusted external hosts.\n\n## TL;DR\nHurl failed to strip cookies defined in the custom [Cookies] block when following cross-origin redirects, leading to potential session hijacking.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-201\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.9 (Medium)\n- **EPSS Score**: 0.00467\n- **Impact**: Sensitive Information Disclosure\n- **Exploit Status**: PoC Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Hurl command-line testing tool (Orange-OpenSource/hurl)\n- **hurl**: <= 8.0.1 (Fixed in: `8.1.0`)\n\n## Mitigation\n\n- Upgrade to Hurl version 8.1.0 or higher\n- Convert native [Cookies] parser blocks into standard raw Cookie headers\n- Disable automated redirect following by setting location: false\n\n**Remediation Steps:**\n1. Scan container configurations and CI/CD environments to identify Hurl installations run on versions <= 8.0.1.\n2. Upgrade software dependencies to draw Hurl version 8.1.0 or higher from upstream distributions.\n3. Where legacy deployments cannot be updated immediately, update .hurl files to replace [Cookies] blocks with standard Cookie headers.\n4. Instruct development teams to avoid enabling the --location-trusted CLI flag when performing operations on unverified URLs.\n\n## References\n\n- [GitHub Security Advisory GHSA-7w2g-9mf9-324m](https://github.com/Orange-OpenSource/hurl/security/advisories/GHSA-7w2g-9mf9-324m)\n- [NVD - CVE-2026-63481](https://nvd.nist.gov/vuln/detail/CVE-2026-63481)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63481) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T12:32:57.632544Z"}