.NET EUVD-2026-99277

Exploitation requires a .NET application using System.Net.Http's SocketsHttpHandler configured with a proxy that uses Basic authentication (so a Proxy-Authorization header is populated), AND an outbound HTTP request that follows a redirect to a server the attacker can observe or control. The leak occurs specifically because the Proxy-Authorization header is not stripped when the request is redirected to a different destination. Limiting factors: High attack complexity (AC:H) because the attacker must induce or exploit a redirect to an attacker-reachable destination while proxy credentials are active; the exposed secret is limited to the Basic proxy credential rather than general application data; applications not using an authenticating proxy with SocketsHttpHandler are not affected.

This is a genuine but moderate-priority issue, not a high-urgency emergency. All exploitation-maturity signals point the same direction and agree with the 5.9 (Medium) CVSS score: CISA SSVC lists Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing and no public proof-of-concept in the provided data, so exploitation status is 'no public exploit identified at time of analysis'. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a network, unauthenticated vector but with High attack complexity, which is the dominant limiter here - the attacker must win a specific condition race (a request that follows a redirect to a server they control while a Basic Proxy-Authorization header is set). Impact is confidentiality-only (C:H, I:N, A:N): the GHSA advisory confirms the leaked data is Basic proxy credentials, not arbitrary secrets, so the C:H rating is arguably generous for a single credential class but defensible. No EPSS score was provided, so probabilistic exploitation likelihood cannot be independently weighed; given SSVC 'Exploitation: none' and 'Automatable: no', real-world risk is best read as low-to-moderate and opportunistic rather than widespread or automatable. Net: patch on a normal cadence; this is not a drop-everything flaw.

A .NET application uses SocketsHttpHandler configured with an HTTP proxy that requires Basic authentication, and makes an outbound request that an attacker can cause to redirect (e.g., to an attacker-controlled destination). Because the handler retains the Proxy-Authorization header across the redirect, the base64-encoded proxy credentials are sent to the destination server, where the attacker captures them. No public exploit code is identified at time of analysis, and the High attack complexity means the attacker must influence the redirect target while proxy auth is active.