GHSA-x565-32qp-m3vf
phin may include sensitive headers in subsequent requests after redirect
Impact
Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled.
Patches
The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations.
Workarounds
N/A. Please update to resolve the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
phin may include sensitive headers in subsequent requests after redirect
Impact
Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled.
Patches
The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations.
Workarounds
N/A. Please update to resolve the issue.
- Record
GHSA-x565-32qp-m3vf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
phin may include sensitive headers in subsequent requests after redirect
Impact
Users may be impacted if sending requests including sensitive data in specific headers with followRedirects enabled.
Patches
The follow-redirects library is now being used for redirects and removes some headers that may contain sensitive information in some situations.
Workarounds
N/A. Please update to resolve the issue.
- Record
GHSA-x565-32qp-m3vf- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVCLSA-2026-1791887874No score
TuxCare security update for phin (1 CVE)
TuxCare rebuilt phin to address 1 CVE. Fixed in 2.9.3-tuxcare.1.
- Record
CLSA-2026-1791887874- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-x565-32qp-m3vf is a medium vulnerability (CVSS 4.3) in phin, published April 11, 2024. No source lists public exploit code. Fixed in phin 3.7.1.