{"id":"ANT-2026-5F0FFVVR","aliases":["ANT-2026-5HZS0066","ANT-2026-8SP7TV55","ANT-2026-8ZCNPQZX","ANT-2026-GM4FVXDB","ANT-2026-HTKXQYJX","ANT-2026-K7VHJB7S","ANT-2026-MBWGTHMA","ANT-2026-PW5H10EB","ANT-2026-R3BBBRAW","ANT-2026-WB9V4R8Q","JLSEC-2026-613"],"status":"published","title":"Redirect credential leakage across scheme/port in HTTP.jl","description":"### Description\n\nRedirect handling decided whether to retain credential-bearing headers (`Authorization`, `Cookie`, `Proxy-Authorization`, etc.) by comparing only the hostname, ignoring scheme and port. As a result an `https`→`http` downgrade or a same-host/different-port redirect was treated as same-origin and replayed credentials over plaintext or to a different service. Additionally, per-call `cookies=` cookies were captured once and re-appended on every hop even after the `Cookie` header was stripped, and the TLS verification host was pinned to the original host across redirects.\n\n### Impact\n\nFollowing an attacker-influenced redirect could disclose a client's credentials or cookies to a different origin (different scheme or port) than the one they were intended for, including over plaintext.\n\n### Patches\n\nFixed in HTTP.jl v2.4.0. Sensitive-header retention now requires matching scheme and port (with default-port normalization) in addition to the existing host/subdomain check, cross-origin hops also clear the explicit `cookies=` vector so they are not re-attached, and the SNI/verification host is recomputed from the redirect target on every hop unless the caller explicitly pinned `server_name`.\n\nReported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-06-23T12:59:32.708Z","modified":"2026-07-21T22:15:04Z","fixes":[{"ecosystem":"Julia","package":"HTTP","fixed_in":["2.4.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Julia","package":"HTTP","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.4.0"}]}]}],"references":[{"url":"https://github.com/JuliaWeb/HTTP.jl/commit/b5c0282c899b75fbca2475ee7efe17e659990420","tags":["web"]},{"url":"https://github.com/JuliaWeb/HTTP.jl/pull/1316","tags":["web"]}],"sources":{"osv":[{"id":"JLSEC-2026-613","title":"Redirect credential leakage across scheme/port in HTTP.jl","description":"### Description\n\nRedirect handling decided whether to retain credential-bearing headers (`Authorization`, `Cookie`, `Proxy-Authorization`, etc.) by comparing only the hostname, ignoring scheme and port. As a result an `https`→`http` downgrade or a same-host/different-port redirect was treated as same-origin and replayed credentials over plaintext or to a different service. Additionally, per-call `cookies=` cookies were captured once and re-appended on every hop even after the `Cookie` header was stripped, and the TLS verification host was pinned to the original host across redirects.\n\n### Impact\n\nFollowing an attacker-influenced redirect could disclose a client's credentials or cookies to a different origin (different scheme or port) than the one they were intended for, including over plaintext.\n\n### Patches\n\nFixed in HTTP.jl v2.4.0. Sensitive-header retention now requires matching scheme and port (with default-port normalization) in addition to the existing host/subdomain check, cross-origin hops also clear the explicit `cookies=` vector so they are not re-attached, and the SNI/verification host is recomputed from the redirect target on every hop unless the caller explicitly pinned `server_name`.\n\nReported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.","status":"published","published":"2026-06-23T12:59:32.708Z","modified":"2026-07-21T22:15:04.517742922Z","updated_at":"2026-11-02T15:47:18.573531Z"}]}}