Findings

CVE-2026-103030

Dio: Cross-origin redirect leaks sensitive request headers in

Published Oct 13, 2026 · updated Oct 15, 2026 · cfug dio

### Summary follows HTTP redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin redirect receives the victim's , , and headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high. ### Details When is configured to use , the adapter's internal method constructs HTTP/2 request headers by unconditionally copying all entries from : On receiving a response, the adapter reads the header and resolves the redirect target URI: is called without an explicit argument; therefore preserves the full original header map via . ( ) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including , , and — is forwarded to the new authority with no sanitization. **Data flow (source → sink):** 1. — public entry point. 2. — base and per-request headers merged into . 3. — dispatches to . 4. — header is read from the network response (attacker-controlled source). 5. — redirect target URI resolved; cross-origin check absent. 6. — called without override. 7. — preserves — all sensitive headers retained. 8. — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink). **Suggested patch** — strip sensitive headers before following a cross-origin redirect: ### PoC The following steps reproduce the vulnerability using two local HTTP/2 cleartext (h2c) servers inside an isolated Docker container (no external network required). **Prerequisites:** - Docker installed and accessible. - Repository checked out at the path used as the build context. **Build and run:** **What the container does:** 1. Starts an *origin* h2c server on that immediately returns . 2. Starts an *attacker* h2c server on that logs every received head