What is the CVSS score of CVE-2026-7017?

CVE-2026-7017 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of HTTP::Tiny are affected by CVE-2026-7017?

Perl HTTP::Tiny client (versions before 0.095) leaks authentication credentials and session cookies when following HTTP redirects to attacker-controlled destinations; while no public exploit has been…. A patch is available.

How to fix or mitigate CVE-2026-7017?

24 hours: Identify all internal applications and third-party dependencies using Perl HTTP::Tiny; document current versions and systems at risk. 7 days: Update Perl HTTP::Tiny to version 0.095 or later on all affected systems, prioritizing applications that handle authentication tokens or sensitive credentials. 30 days: Verify completion of patching across all deployments, conduct functional testing of HTTP client behavior, and document the remediation.

HTTP::Tiny CVE-2026-7017

EUVD-2026-42072 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-07-07 CPANSec

GHSA-pgc4-5jjm-7rr7

Information Disclosure Http Suse

7.1

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity credential disclosure needing no privileges but requiring the client to make a redirected request (UI:R); impact is pure confidentiality so I and A are N.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 21:02 vuln.today

CVSS changed

Jul 07, 2026 - 19:22 NVD

7.1 (HIGH)

CVE Published

Jul 07, 2026 - 17:41 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.

When the server returns a 3xx redirect, _maybe_redirect follows the Location: header and _prepare_headers_and_cb re-merges the caller's headers argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied Authorization, Cookie and Proxy-Authorization headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including https to http downgrades that expose them in plaintext on the wire.

The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

AnalysisAI

Credential leakage in the Perl HTTP::Tiny client (all versions before 0.095) lets an attacker who controls a redirect destination harvest sensitive headers. When a server answers with a 3xx redirect, HTTP::Tiny re-sends caller-supplied Authorization, Cookie and Proxy-Authorization headers to the new host without verifying it shares the original origin, including across scheme, host or port boundaries and over https-to-http downgrades that expose them in cleartext on the wire. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as none, but the flaw is well-documented and a vendor patch is available in 0.095.

Technical ContextAI

HTTP::Tiny is a small, dependency-free HTTP/1.1 user agent that ships with Perl core and underlies much of the CPAN toolchain and countless scripts. The defect is in its redirect-following logic: _maybe_redirect follows the Location: header on a 3xx response, and _prepare_headers_and_cb re-merges the caller's original headers hash into the follow-up request with no same-origin check. The module's POD claimed 'Authorization headers will not be included in a redirected request,' but that stripping only ever applied to Basic-auth credentials parsed from the URL userinfo, not to headers the caller passed explicitly. This maps to CWE-522 (Insufficiently Protected Credentials): secrets intended for one origin are transmitted to an unrelated origin, and the affected component is precisely cpe:2.3:a:haarg:http::tiny.

RemediationAI

Vendor-released patch: upgrade HTTP::Tiny to 0.095 (initially published as the 0.095-TRIAL release at https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes); the fixes are in commits 84984ef3, e7a03aed and 8f32ca89 (PR https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36). If you cannot upgrade immediately, the most effective compensating control is to disable automatic redirect following by setting max_redirect => 0 on the client, then inspect the Location header and re-issue the request yourself only when the target origin matches - the trade-off is that legitimate redirect-based workflows break and must be handled manually. Alternatively, stop passing Authorization, Cookie and Proxy-Authorization via the explicit headers argument for requests that may redirect, or attach credential headers only after confirming the final resolved host, which adds application complexity. Also avoid non-TLS (http) endpoints for authenticated calls to prevent downgrade exposure. See the coordinated advisory at https://seclists.org/oss-sec/2026/q3/87 and https://vuldb.com/vuln/376670.