CVE-2026-7017

HighCVSS 7.1

Published: 07/07/2026(UTC)Updated: 08/07/2026(UTC)Translated: 09/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Vulnerability in HTTP::Tiny for Perl before version 0.095 causes credential headers (Authorization, Cookie, Proxy-Authorization) to be forwarded to cross-origin redirect targets. The redirect mechanism does not verify whether the redirect target shares an origin with the original URL, allowing sensitive data leakage.

Risk Assessment

The organization risks exposure of sensitive authentication data (e.g., session tokens, passwords) to third parties, including over unencrypted HTTP connections, potentially leading to account takeover or man-in-the-middle attacks.

Recommendation

Immediately upgrade HTTP::Tiny to version 0.095 or later. If upgrade is not possible, avoid passing authentication headers in HTTP::Tiny calls or manually control redirects.

Other vulnerabilities in HTTP::Tiny

CVE-2026-7010Medium
HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs include the method and URI in the request line and the URL host that becomes the `Host:` header.

Original NVD description (English source)

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.