cve-replay

CVE 重放：重定向头边界 CVE-2026-44431 · urllib3 2.6.3 → 2.7.0 · 复现于 2026 年 9 月 27 日 一个请求携带三个敏感头信息发往某个源。一次重定向改变了目标地址。下一个请求是否仍然携带它们？ 这个独立的回归测试运行了来自两个确切 urllib3 版本的真实重定向实现。版本 2.6.3 在受影响的底层 API 中保留了全部三个头信息。版本 2.7.0 移除了它们。一个无害的头信息得以保留，普通请求仍然正常工作。 实测结果 测试用例| urllib3 2.6.3| urllib3 2.7.0 ---|---|--- 底层跨源重定向| 保留 ...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by an information disclosure vulnerability in urllib3 (CVE-2026-44431)

Summary An information disclosure vulnerability in the urllib3 HTTP client library CVE-2026-44431 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 2.7.0. Vulnerability Details CVEID:CVE-2026-44431 DESCRIPTION: urllib3 is an HTTP client library f...

CVE-2026-44431: Exposure of Sensitive Information to an Unauthorized Actor

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connectionfromurl.urlopen..., assertsamehost=False still forward these sensitive headers. This vulnerability is fixed in 2.7.0...