Orange-OpenSource hurl vulnerabilities

Latest Orange-OpenSource hurl CVEs

Newest publication first

1. CVE-2026-63481 Hurl: Cookies in Cookies section leak when redirecting to a different host

   Published 2026-08-20

   Medium·CVSS 6.9 EPSS 0.66%

   Hurl is a command line tool that runs and tests HTTP requests defined in plain text files. In version 8.0.1 and earlier, the redirect handling in packages/hurl/src/http/client.rs strips Authorization and Cookie headers and basic-auth credentials when a redirect changes host, but...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.