Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Perl HTTP::Tiny can send credentials to wrong site
published 4 months ago
Summary
When a Perl program uses HTTP::Tiny and follows a redirect, it may resend authentication cookies or passwords to the new address, even if that address is a different website or uses an insecure connection. This can expose user credentials to attackers. Upgrade to the latest version of HTTP::Tiny or modify the code to stop sending sensitive headers after a redirect.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | perl | <= 5.38.2-517 |
Original advisory text
CVE-2026-7017 affecting package perl 5.38.2-517
HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.
The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.
When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.
The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.
References
Timeline
Published7 Jul 2026
Updated2 Nov 2026
First seen2 Nov 2026
Sources
AZL-112454 · OSV
Track software like this
Free during beta