new file mode 100644
@@ -0,0 +1,139 @@
+From 8e8bdd36048c146fe843d8948a912fbd398d1c5d Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Wed, 1 Apr 2026 08:09:47 +0200
+Subject: [PATCH] cookie: fix rejection when tabs in value
+
+A previous refactor changed the TAB check so that the octet could be
+accepted in the 'path', which would cause an invalid line in the saved
+cookie file so not possible to read the cookie back. Not terrible
+because the path cannot contain a raw tab anyway so it would never match
+anyway.
+
+Add test 1685 to verify
+
+Reported-by: Izan on hackerone
+
+Closes #21185
+
+CVE: CVE-2026-80255
+Upstream-Status: Backport [https://github.com/curl/curl/commit/8e8bdd36048c146fe843d8948a912fbd398d1c5d]
+
+Backport Changes:
+- Registered test 1685 in the older curl 8.19.0 test-list row.
+
+(cherry picked from commit 8e8bdd36048c146fe843d8948a912fbd398d1c5d)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cookie.c | 14 ++++++-------
+ tests/data/Makefile.am | 2 +-
+ tests/data/test1685 | 57 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 65 insertions(+), 8 deletions(-)
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 4d53cc4..cd95130 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -461,6 +461,13 @@ parse_cookie_header(struct Curl_easy *data,
+ sep = TRUE; /* a '=' was used */
+ if(!curlx_str_cspn(&ptr, &val, ";\r\n"))
+ curlx_str_trimblanks(&val);
++
++ /* Reject cookies with a TAB inside the value */
++ if(curlx_strlen(&val) &&
++ memchr(curlx_str(&val), '\t', curlx_strlen(&val))) {
++ infof(data, "cookie contains TAB, dropping");
++ return CURLE_OK;
++ }
+ }
+ else
+ curlx_str_init(&val);
+@@ -489,13 +496,6 @@ parse_cookie_header(struct Curl_easy *data,
+ return CURLE_OK;
+ }
+
+- /* Reject cookies with a TAB inside the value */
+- if(curlx_strlen(&val) &&
+- memchr(curlx_str(&val), '\t', curlx_strlen(&val))) {
+- infof(data, "cookie contains TAB, dropping");
+- return CURLE_OK;
+- }
+-
+ /* Check if we have a reserved prefix set. */
+ if(!strncmp("__Secure-", curlx_str(&name), 9))
+ co->prefix_secure = TRUE;
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index ea700cd..5bb4f7e 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -226,7 +226,7 @@ test1660 test1661 test1662 test1663 test1664 test1665 \
+ \
+ test1670 test1671 \
+ \
+-test1680 test1681 test1682 test1683 \
++test1680 test1681 test1682 test1683 test1685 \
+ \
+ test1700 test1701 test1702 test1703 test1704 test1705 test1706 test1707 \
+ test1708 test1709 test1710 test1711 test1712 \
+diff --git a/tests/data/test1685 b/tests/data/test1685
+new file mode 100644
+index 0000000..b98dc20
+--- /dev/null
++++ b/tests/data/test1685
+@@ -0,0 +1,57 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++# Server-side
++<reply>
++<data crlf="headers">
++HTTP/1.0 200 OK swsclose
++Date: Tue, 09 Nov 2010 14:49:00 GMT
++Content-Type: text/html
++Set-Cookie: name=content; path=/we%TABwant
++Set-Cookie: accept=this; path=/only/this
++
++boo
++</data>
++</reply>
++
++# Client-side
++<client>
++<server>
++http
++</server>
++<name>
++HTTP, reject cookie with tab in path
++</name>
++<command>
++http://%HOSTIP:%HTTPPORT/ -c %LOGDIR/jar%TESTNUMBER.txt
++</command>
++
++<features>
++cookies
++</features>
++</client>
++
++# Verify data after the test has been "shot"
++<verify>
++<protocol crlf="headers">
++GET / HTTP/1.1
++Host: %HOSTIP:%HTTPPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++<file name="%LOGDIR/jar%TESTNUMBER.txt" mode="text">
++# Netscape HTTP Cookie File
++# https://curl.se/docs/http-cookies.html
++# This file was generated by libcurl! Edit at your own risk.
++
++127.0.0.1%TABFALSE%TAB/only/this%TABFALSE%TAB0%TABaccept%TABthis
++</file>
++</verify>
++</testcase>
new file mode 100644
@@ -0,0 +1,125 @@
+From 4f6aa41a0145e930e766775dbe860883d350aa0a Mon Sep 17 00:00:00 2001
+From: Daniel Stenberg <daniel@haxx.se>
+Date: Thu, 27 Aug 2026 08:33:30 +0200
+Subject: [PATCH] cookie: improve TAB handling
+
+For entries with a leading tab. Verified in test 2885.
+
+Reported-by: Stanislav Fort
+Closes #22699
+
+CVE: CVE-2026-80255
+Upstream-Status: Backport [https://github.com/curl/curl/commit/4f6aa41a0145e930e766775dbe860883d350aa0a]
+
+Backport Changes:
+- Made invalid_octets() reject TAB as required by the curl 8.19.0
+ parser; without this adaptation, upstream test 1105 regresses.
+- Registered test 2885 in the older test-list layout.
+
+(cherry picked from commit 4f6aa41a0145e930e766775dbe860883d350aa0a)
+Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
+---
+ lib/cookie.c | 6 ++---
+ tests/data/Makefile.am | 2 +-
+ tests/data/test2885 | 52 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 56 insertions(+), 4 deletions(-)
+ create mode 100644 tests/data/test2885
+
+diff --git a/lib/cookie.c b/lib/cookie.c
+index 4d53cc4..c3adf1d 100644
+--- a/lib/cookie.c
++++ b/lib/cookie.c
+@@ -354,9 +354,9 @@ static bool bad_domain(const char *domain, size_t len)
+ static bool invalid_octets(const char *ptr, size_t len)
+ {
+ const unsigned char *p = (const unsigned char *)ptr;
+- /* Reject all bytes \x01 - \x1f (*except* \x09, TAB) + \x7f */
++ /* Reject all bytes \x01 - \x1f + \x7f */
+ while(len && *p) {
+- if(((*p != 9) && (*p < 0x20)) || (*p == 0x7f))
++ if((*p < 0x20) || (*p == 0x7f))
+ return TRUE;
+ p++;
+ len--;
+@@ -453,7 +453,7 @@ parse_cookie_header(struct Curl_easy *data,
+ struct Curl_str val;
+
+ /* we have a <name>=<value> pair or a stand-alone word here */
+- if(!curlx_str_cspn(&ptr, &name, ";\t\r\n=")) {
++ if(!curlx_str_cspn(&ptr, &name, ";\r\n=")) {
+ bool sep = FALSE;
+ curlx_str_trimblanks(&name);
+
+diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am
+index 13e47a3..18e7730 100644
+--- a/tests/data/Makefile.am
++++ b/tests/data/Makefile.am
+@@ -272,7 +272,7 @@ test2600 test2601 test2602 test2603 test2604 test2605 \
+ test2700 test2701 test2702 test2703 test2704 test2705 test2706 test2707 \
+ test2708 test2709 test2710 test2711 test2712 test2713 test2714 test2715 \
+ test2716 test2717 test2718 test2719 test2720 test2721 test2722 test2723 \
+-\
++test2885 \
+ test3000 test3001 test3002 test3003 test3004 test3005 test3006 test3007 \
+ test3008 test3009 test3010 test3011 test3012 test3013 test3014 test3015 \
+ test3016 test3017 test3018 test3019 test3020 test3021 test3022 test3023 \
+diff --git a/tests/data/test2885 b/tests/data/test2885
+new file mode 100644
+index 0000000..456224f
+--- /dev/null
++++ b/tests/data/test2885
+@@ -0,0 +1,52 @@
++<?xml version="1.0" encoding="US-ASCII"?>
++<testcase>
++<info>
++<keywords>
++HTTP
++cookies
++</keywords>
++</info>
++
++<reply>
++<data crlf="headers">
++HTTP/1.1 200 OK
++Content-Length: 0
++Set-Cookie: thisis=SECRET;%TABSecure
++Set-Cookie: also=notab; Secure
++
++</data>
++</reply>
++
++<client>
++<features>
++cookies
++</features>
++<server>
++https
++</server>
++<name>
++Cookies with TAB before 'secure'
++</name>
++<command>
++https://cookie.example:%HTTPSPORT/%TESTNUMBER -c %LOGDIR/cookies.txt --resolve cookie.example:%HTTPSPORT:%HOSTIP --insecure
++</command>
++</client>
++
++<verify>
++<protocol crlf="headers">
++GET /%TESTNUMBER HTTP/1.1
++Host: cookie.example:%HTTPSPORT
++User-Agent: curl/%VERSION
++Accept: */*
++
++</protocol>
++<file name="%LOGDIR/cookies.txt" mode="text">
++# Netscape HTTP Cookie File
++# https://curl.se/docs/http-cookies.html
++# This file was generated by libcurl! Edit at your own risk.
++
++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABalso%TABnotab
++cookie.example%TABFALSE%TAB/%TABTRUE%TAB0%TABthisis%TABSECRET
++</file>
++</verify>
++</testcase>
+--
+2.35.6
@@ -42,6 +42,8 @@ SRC_URI = "https://curl.se/download/${BP}.tar.xz \
file://CVE-2026-8926_p1.patch \
file://CVE-2026-8926_p2.patch \
file://CVE-2026-11564.patch \
+ file://CVE-2026-80255-dependent.patch \
+ file://CVE-2026-80255.patch \
file://CVE-2026-80230.patch \
"