CVE-2026-7017HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets
Updated under an hour ago ()
Does this affect you?
It affects HAARG HTTP::Tiny. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.
- CVSS
- 7.1 HIGH (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
- Weakness (CWE)
- CWE-522
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- CPANSec
- NVD analysis
- Deferred
- Record last updated
- Jul 7, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
HAARG HTTP::Tiny haarg:http_tiny (from the name) | before 0.095 | CNA record |
References
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36issue-tracking
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patchpatch
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patchpatch
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patchpatch
- https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changesrelease-notes
- http://www.openwall.com/lists/oss-security/2026/07/07/13
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.