HTTP::Tiny CVE-2026-7017

Exploitation requires three concrete prerequisites: (1) the calling Perl code must pass a credential header - Authorization, Cookie, or Proxy-Authorization - via HTTP::Tiny's explicit headers argument; (2) automatic redirect following must be active, which is the default (HTTP::Tiny follows redirects unless max_redirect is lowered); and (3) the attacker must be able to make the requested server emit a 3xx Location pointing to an origin they control, either by owning/compromising that server or by acting as a man-in-the-middle. Limiting factors: the flaw does not fire for credentials derived from URL userinfo (already stripped), it needs the victim client to actually initiate the request (CVSS UI:R), and applications that never send explicit credential headers or that disable redirects are unaffected. The https-to-http downgrade exposure additionally requires the redirect to name a plaintext http target.

The signals are largely consistent and point to a moderate, disclosure-oriented risk rather than an urgent RCE-class emergency. The CVSS 3.1 base of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) reflects a network-reachable, low-complexity, unauthenticated confidentiality loss that still depends on victim interaction (the client must make a request that gets redirected). CISA's SSVC framework aligns with lower urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided. Key caveat: exploitation requires the calling application to explicitly send credential headers AND an attacker to influence the redirect target (by controlling/compromising the requested server or via man-in-the-middle injecting a 3xx), so real-world exposure is narrower than the network vector alone implies. The I:L in the vendor vector is debatable - the primary demonstrated impact is confidentiality, though leaked credentials can be replayed.

An application uses HTTP::Tiny to call an API with an explicit Authorization or Cookie header; an attacker who controls, has compromised, or can MITM that endpoint returns a 302 redirect pointing at attacker.example. HTTP::Tiny transparently follows the redirect and re-sends the same credential headers to the attacker's host, who logs the bearer token or session cookie and replays it. No exploit code is publicly identified, but the network-based, low-complexity nature (AV:N/AC:L) makes the technique straightforward once a redirect can be influenced.