CVE-2016-6287

High

Published: 10/01/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The 'http-client' package always used the HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI process. This could allow an attacker to direct all HTTP requests through a proxy using the 'Proxy' header.

Risk Assessment

The httpoxy attack can lead to user data interception and network traffic manipulation, posing a serious security threat to web applications.

Recommendation

It is recommended to update the 'http-client' package to version 0.10 or later to mitigate the risk associated with this vulnerability.

Other vulnerabilities in http-client

CVE-2026-1502Medium
A vulnerability in the HTTP client allows CR/LF bytes to be injected into proxy tunnel headers or host, potentially leading to HTTP response splitting or cache poisoning attacks.

Original NVD description (English source)

The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI process. Under several web servers this would mean a user-supplied "Proxy" header could allow an attacker to direct all HTTP requests through a proxy (also known as a "httpoxy" attack). This affects all versions of http-client before 0.10.