Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:46:46 +0000 CVE-2026-44503 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect https://vulnerability.circl.lu/vuln/cve-2026-44503 <p><strong>Affected:</strong> microsoft kiota-java, Microsoft.Kiota.Abstractions, microsoft github.com/microsoft/kiota-http-go, microsoft kiota-typescript, microsoft-kiota-abstractions, microsoft-kiota-http</p> <p>The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.</p> <p><strong>Affected:</strong> microsoft kiota-java, Microsoft.Kiota.Abstractions, microsoft github.com/microsoft/kiota-http-go, microsoft kiota-typescript, microsoft-kiota-abstractions, microsoft-kiota-http</p> <p>The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.</p> https://vulnerability.circl.lu/vuln/cve-2026-44503