{"id":"CVE-2026-7017","aliases":["ALPINE-CVE-2026-7017","AZL-112454","DEBIAN-CVE-2026-7017","EUVD-2026-42072","GHSA-pgc4-5jjm-7rr7","OESA-2026-3169","ROOT-OS-DEBIAN-11-CVE-2026-7017","ROOT-OS-DEBIAN-12-CVE-2026-7017","ROOT-OS-DEBIAN-13-CVE-2026-7017","UBUNTU-CVE-2026-7017","USN-8684-1","openSUSE-SU-2026:11219-1","openSUSE-SU-2026:21529-1"],"status":"published","title":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00349,"percentile":0.28713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-522"],"published":"2026-07-07T17:41:48Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.24","package":"perl","fixed_in":["5.42.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libhttp-tiny-perl","fixed_in":["0.090-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libhttp-tiny-perl","fixed_in":["0.096-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.36.0-7+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.42.3-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-HTTP-Tiny","fixed_in":["0.080-4.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-HTTP-Tiny","fixed_in":["0.088-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-HTTP-Tiny","fixed_in":["0.088-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-HTTP-Tiny","fixed_in":["0.088-3.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-HTTP-Tiny","fixed_in":["0.076-6.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"perl","fixed_in":["5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-perl","fixed_in":["5.32.1-4+deb11u5.aikido.7","5.32.1-4+deb11u5.aikido.8","5.32.1-4+deb11u5.aikido.9","5.32.1-4+deb11u5.aikido.10","5.32.1-4+deb11u5.aikido.11","5.32.1-4+deb11u5.aikido.12"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"perl","fixed_in":["5.38.2-3.2ubuntu0.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Tiny","fixed_in":["0.096-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-HTTP-Tiny","fixed_in":["0.096-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.38.2-517"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.082-2","0.088-1","0.090-1","0.092-1","0.092-2","0.092-3","0.096-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.090-1+deb13u1"}]}],"versions":["0.090-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.096-1"}]}],"versions":["0.090-1","0.092-1","0.092-2","0.092-3"]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4"}]}],"versions":["5.36.0-7","5.36.0-7+deb12u1","5.36.0-7+deb12u2","5.36.0-7+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1"}]}],"versions":["5.40.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.3-1"}]}],"versions":["5.40.1-6","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2","5.42.2-3"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.080-4.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.088-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.088-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.088-3.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.076-6.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.32.1-4+deb11u5.aikido.7"},{"fixed":"5.32.1-4+deb11u5.aikido.8"},{"fixed":"5.32.1-4+deb11u5.aikido.9"},{"fixed":"5.32.1-4+deb11u5.aikido.10"},{"fixed":"5.32.1-4+deb11u5.aikido.11"},{"fixed":"5.32.1-4+deb11u5.aikido.12"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8","5.18.2-2ubuntu1.7+esm9"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3","5.22.1-9ubuntu0.9+esm4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.056-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3","5.26.1-6ubuntu0.7+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.070-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3","5.30.0-9ubuntu0.5+esm4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.076-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.076-1","0.080-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7","5.34.0-3ubuntu1.8","5.34.0-3ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.082-2","0.088-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.090-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-2","5.40.1-3","5.40.1-5","5.40.1-6","5.40.1-6build1","5.40.1-6ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.092-1","0.092-3","0.096-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-7build1","5.40.1-8","5.40.1-8ubuntu1","5.42.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhttp-tiny-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.090-1","0.092-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1","5.40.1-7ubuntu0.2","5.40.1-7ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.4"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.096-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-HTTP-Tiny","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.096-bp160.1.1"}]}]}],"products":[{"vendor":"haarg","product":"http::tiny"}],"references":[{"url":"https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","tags":["issue-tracking","report"]},{"url":"https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","tags":["patch","fix"]},{"url":"https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","tags":["patch","fix"]},{"url":"https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","tags":["patch","fix"]},{"url":"https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","tags":["release-notes","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/07/13","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pgc4-5jjm-7rr7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-7017","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7017.json","tags":["advisory"]},{"url":"https://github.com/Perl-Toolchain-Gang/HTTP-Tiny","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7017","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3169","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7017","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7017","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/41618211/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8684-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-15649","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-9538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-12087","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-13221","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48959","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-48962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-57433","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-7017","tags":["web"]},{"url":"https://bugzilla.suse.com/1271020","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-7017","title":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T17:41:48.989Z","modified":"2026-07-07T20:35:36.874Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:20:05.830416Z"}],"euvd":[{"id":"EUVD-2026-42072","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T17:41:48Z","modified":"2026-07-07T20:35:36Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:11.442824Z"}],"ghsa":[{"id":"GHSA-pgc4-5jjm-7rr7","title":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect...","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T21:31:35Z","modified":"2026-07-07T21:31:43Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:09:18.783285Z"}],"nvd":[{"id":"CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T19:16:55.53Z","modified":"2026-10-25T20:10:00.147Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:28.040501Z"}],"osv":[{"id":"ALPINE-CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T19:16:55.53Z","modified":"2026-11-03T19:30:02.809058067Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-03T20:03:57.215693Z"},{"id":"CVE-2026-7017","title":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T17:41:48.989Z","modified":"2026-10-28T02:30:38.331300958Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:45:15.164658Z"},{"id":"DEBIAN-CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.  When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.  The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T19:16:55.53Z","modified":"2026-10-26T11:47:30.180675581Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:02.094661Z"},{"id":"OESA-2026-3169","title":"perl-HTTP-Tiny security update","description":"This is a very simple HTTP/1.1 client, designed for doing simple requests  without the overhead of a large framework like LWP::UserAgent.\r\n\r\nSecurity Fix(es):\n\nHTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller\u0026apos;s `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \u0026quot;Authorization headers will not be included in a redirected request\u0026quot; applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.(CVE-2026-7017)","status":"published","published":"2026-07-24T11:12:02Z","modified":"2026-08-18T01:21:24.182048199Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T19:16:00Z","modified":"2026-10-17T12:59:30.301444479Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:57.159276Z"},{"id":"AZL-112454","title":"CVE-2026-7017 affecting package perl 5.38.2-517","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","status":"published","published":"2026-07-07T19:16:55Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:19.001909Z"},{"id":"openSUSE-SU-2026:11219-1","title":"perl-HTTP-Tiny-0.096-2.1 on GA media","description":"These are all security issues fixed in the perl-HTTP-Tiny-0.096-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-08T00:00:00Z","modified":"2026-07-09T10:00:13.39779428Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21529-1","title":"Security update for perl-HTTP-Tiny","description":"This update for perl-HTTP-Tiny fixes the following issues:\n\nChanges in perl-HTTP-Tiny:\n\n- updated to 0.096\n- CVE-2026-7017: Fixed forwarded credential headers to cross-origin redirect targets (bsc#1271020)\n- Caller-supplied Authorization, Cookie, and Proxy-Authorization\n  headers are now stripped on cross-origin redirects by default. Use\n  allow_credentialed_redirects to opt out.\n- Redirects are no longer automatically followed when going from https to http.\n  Use allow_downgrade to revert to the original behaviour.\n","status":"published","published":"2026-08-04T14:58:00Z","modified":"2026-08-05T18:23:53.257384161Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-7017","title":"CVE-2026-7017 in perl - Patched by Root","description":"Root has patched CVE-2026-7017 in the perl package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T08:42:48Z","modified":"2026-08-23T10:16:22.89943528Z","updated_at":"2026-11-02T15:53:30.44348Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-7017","title":"CVE-2026-7017 in perl - Patched by Root","description":"Root has patched CVE-2026-7017 in the perl package for Root:Debian:12. Multiple fixed versions available.","status":"withdrawn","published":"2026-09-28T14:31:33Z","modified":"2026-10-08T19:00:06.99117472Z","updated_at":"2026-11-02T15:53:32.570806Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-7017","title":"CVE-2026-7017 in perl - Patched by Root","description":"Root has patched CVE-2026-7017 in the perl package for Root:Debian:13. Multiple fixed versions available.","status":"withdrawn","published":"2026-08-24T16:37:37Z","modified":"2026-09-16T20:00:05.430335539Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"USN-8684-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled certain arguments to\nSocket and pack/unpack functions. An attacker could possibly use this\nissue to read sensitive information from memory.\n(CVE-2026-12087, CVE-2026-57432)\n\nIt was discovered that Perl incorrectly handled regular expressions\nwith a large number of alternation branches. An attacker could\npossibly use this issue to cause incorrect matching results.\n(CVE-2026-13221)\n\nIt was discovered that Perl incorrectly handled certain files. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2026-57433, CVE-2025-15649, CVE-2026-48959, CVE-2026-9538)\n\nIt was discovered that Perl incorrectly handled certain inputs. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-48962)\n\nIt was discovered that Perl incorrectly handled credential headers\nduring cross-origin redirects in HTTP::Tiny. An attacker could\npossibly use this issue to expose sensitive information.\n(CVE-2026-7017)","status":"published","published":"2026-08-27T11:10:17Z","modified":"2026-08-31T17:26:26.312880608Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}