Description
Using libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom `Host:` header set, the second request would use stale information and pass on cookies meant for the first host in the second request. Leak them.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
curl curl
Default version status: unaffected
7.71.0 to < 8.14.2affected8.15.0 to < 8.16.1affected8.17.0 to < 8.20.0affected
curl curl
Default version status: unaffected
e15e51384a423be31318b3c9c7d612a1aae661fd to < 3a19987a87f393d9394fe5acc7643f6c263c92dbaffected
curl curl
Default version status: unaffected
8.19.0affected8.18.0affected8.17.0affected8.16.0affected8.15.0affected8.14.1affected8.14.0affected8.13.0affected8.12.1affected8.12.0affected8.11.1affected8.11.0affected8.10.1affected8.10.0affected8.9.1affected8.9.0affected8.8.0affected8.7.1affected8.7.0affected8.6.0affected8.5.0affected8.4.0affected8.3.0affected8.2.1affected8.2.0affected8.1.2affected8.1.1affected8.1.0affected8.0.1affected8.0.0affected7.88.1affected7.88.0affected7.87.0affected7.86.0affected7.85.0affected7.84.0affected7.83.1affected7.83.0affected7.82.0affected7.81.0affected7.80.0affected7.79.1affected7.79.0affected7.78.0affected7.77.0affected7.76.1affected7.76.0affected7.75.0affected7.74.0affected7.73.0affected7.72.0affected7.71.1affected7.71.0affected