{"id":"AZL-112454","summary":"CVE-2026-7017 affecting package perl 5.38.2-517","details":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.","modified":"2026-11-04T05:35:52Z","published":"2026-07-07T19:16:55Z","upstream":["CVE-2026-7017"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017"}],"affected":[{"package":{"name":"perl","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/perl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.38.2-517"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-112454.json"}}],"schema_version":"1.9.2"}