CVE-2026-7017

Name of the Vulnerable Software and Affected Versions HTTP::Tiny versions prior to 0.095

Description When a server returns a 3xx redirect, the maybe redirect function follows the Location: header and the prepare headers and cb function re-merges the caller's headers argument into the new request. This process occurs without verifying if the redirect target shares an origin with the original URL. Consequently, caller-supplied Authorization, Cookie, and Proxy-Authorization headers are sent to any host specified in the redirect, regardless of scheme, host, or port boundaries. This includes downgrades from https to http, which can expose these credentials in plaintext.

Recommendations Update to version 0.095 or later.