CVE-2026-7017

CVE Enrichment

CVSS: 7.1 HIGH
EPSS: 0.25%
EPSS Percentile: 15.02%
CISA KEV: Not listed

Description

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Published: 08-Jul-2026 02:16
Last Modified: 08-Jul-2026 22:56
EPSS Date: 2026-10-20
CWE: CWE-522

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:R /
                            S:U /
                            C:H /
                            I:L /
                            A:N

References

Last enrichment sync: 01-Nov-2026 20:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

perl and libhttp-tiny-perl both carry CVE-2026-7017, credential forwarding on redirects. Debian 13.7 Bundles 92 Security Advisories and Updates 106 Packages

CVE (19)

Products (18)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.