EUVD-2026-98921

Dio: Cross-origin redirect leaks sensitive request headers in diohttp2adapter...

CVE-2026-103030

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...

CVE-2026-103030

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...

CVE-2026-103030

The Dio HTTP client for Dart and Flutter contains a vulnerability in the dio_http2_adapter component (versions 1.0.0 through 2.8.0). The root cause is that Http2Adapter._fetch follows redirects by copying the original RequestOptions.headers into the redirected HTTP/2 request without performing cr...

CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...

CVE-2026-103030: Exposure of Sensitive Information to an Unauthorized Actor

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...