ANT-2026-5F0FFVVR
Redirect credential leakage across scheme/port in HTTP.jl
Description
Redirect handling decided whether to retain credential-bearing headers (Authorization, Cookie, Proxy-Authorization, etc.) by comparing only the hostname, ignoring scheme and port. As a result an https→http downgrade or a same-host/different-port redirect was treated as same-origin and replayed credentials over plaintext or to a different service. Additionally, per-call cookies= cookies were captured once and re-appended on every hop even after the Cookie header was stripped, and the TLS verification host was pinned to the original host across redirects.
Impact
Following an attacker-influenced redirect could disclose a client's credentials or cookies to a different origin (different scheme or port) than the one they were intended for, including over plaintext.
Patches
Fixed in HTTP.jl v2.4.0. Sensitive-header retention now requires matching scheme and port (with default-port normalization) in addition to the existing host/subdomain check, cross-origin hops also clear the explicit cookies= vector so they are not re-attached, and the SNI/verification host is recomputed from the redirect target on every hop unless the caller explicitly pinned server_name.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
What each source reports
OSVJLSEC-2026-613 No score
Redirect credential leakage across scheme/port in HTTP.jl
Description
Redirect handling decided whether to retain credential-bearing headers (Authorization, Cookie, Proxy-Authorization, etc.) by comparing only the hostname, ignoring scheme and port. As a result an https→http downgrade or a same-host/different-port redirect was treated as same-origin and replayed credentials over plaintext or to a different service. Additionally, per-call cookies= cookies were captured once and re-appended on every hop even after the Cookie header was stripped, and the TLS verification host was pinned to the original host across redirects.
Impact
Following an attacker-influenced redirect could disclose a client's credentials or cookies to a different origin (different scheme or port) than the one they were intended for, including over plaintext.
Patches
Fixed in HTTP.jl v2.4.0. Sensitive-header retention now requires matching scheme and port (with default-port normalization) in addition to the existing host/subdomain check, cross-origin hops also clear the explicit cookies= vector so they are not re-attached, and the SNI/verification host is recomputed from the redirect target on every hop unless the caller explicitly pinned server_name.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
- Record
JLSEC-2026-613- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HTTPJulia |
before 2.4.0 | 2.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
ANT-2026-5F0FFVVR is a vulnerability with no CVSS score yet in HTTP, published June 23, 2026. No source lists public exploit code. Fixed in HTTP 2.4.0.