Log in Start free

Vulnerability · Published Jul 7, 2026 · Assigned by CPANSec

CVE-2026-7017HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets

High 7.1

In plain English

A high-severity security flaw in HTTP::Tiny from HAARG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.3%top 71.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24perl5.42.3-r0ALPINE-CVE-2026-7017
Debian:12libhttp-tiny-perlno fix listedDEBIAN-CVE-2026-7017
Debian:13libhttp-tiny-perl0.090-1+deb13u1DEBIAN-CVE-2026-7017
Debian:14libhttp-tiny-perl0.096-1DEBIAN-CVE-2026-7017
Debian:12perl5.36.0-7+deb12u4DEBIAN-CVE-2026-7017
Debian:13perl5.40.1-6+deb13u1DEBIAN-CVE-2026-7017
Debian:14perl5.42.3-1DEBIAN-CVE-2026-7017
Ubuntu:22.04:LTSlibhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:24.04:LTSlibhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:25.10libhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:26.04:LTSlibhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:26.10libhttp-tiny-perlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:22.04:LTSperlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:24.04:LTSperl5.38.2-3.2ubuntu0.4UBUNTU-CVE-2026-7017
Ubuntu:24.04:LTSperl5.38.2-3.2ubuntu0.4USN-8684-1
Ubuntu:25.10perlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:26.04:LTSperlno fix listedUBUNTU-CVE-2026-7017
Ubuntu:26.10perlno fix listedUBUNTU-CVE-2026-7017

Affected products (as reported)

VendorProductVersions
HAARG HTTP::Tiny 0 – before 0.095

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References