Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hurl | rust | <= 8.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-63481, describes a cookie leakage issue in Hurl during cross-host redirects. Specifically, cookies defined in the [Cookies] section were not stripped when redirecting to a different host, unlike Authorization and Cookie headers. The provided commit ed91c894c2cf11704422010554037e3ba70b446e directly addresses this issue. By examining the patch for packages/hurl/src/http/client.rs, it's clear that the execute_with_redirect function was modified. Before the patch, the request_spec.cookies were directly passed to the new request specification without being cleared. The fix introduces a local mutable cookies variable, copies request_spec.cookies into it, and then clears this cookies variable if a cross-host redirect is detected (within the should_strip_credentials_on_redirect condition). This ensures that cookies from the [Cookies] section are no longer forwarded to different hosts, thus preventing the information leak. Therefore, Client.execute_with_redirect is the function that contained the vulnerability.
Client.execute_with_redirectpackages/hurl/src/http/client.rs