CVE-2026-93387

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

GHSA-F8M2-889X-VW4X AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...

AsyncHttpClient re-sends client-wide realm credentials to a cross-origin redirect target

Impact A client configured with a client-wide realm a Realm set on the config builder rather than on an individual request and following redirects could re-send those credentials to a redirect target on a different origin. The redirect code strips the per-exchange realm, but when the target...

Insufficiently Protected Credentials

Overview org.asynchttpclient:async-http-client is a maven plugin for the Async Http Client AHC classes. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the redirect authentication path in Interceptors.java. An attacker can obtain client-wide realm...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

UBUNTU-CVE-2026-85717

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

EUVD-2026-81905

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-85717

CVE-2026-85717 affects the AsyncHttpClient (AHC) Java library, versions 2.14.5–2.16.0 and 3.0.9–3.0.11 . When a client is configured with a client-wide Realm and redirect following , the Interceptors authentication path falls back to the client configuration after redirect handling clears the per...

CVE-2026-85717 AsyncHttpClient: Client-wide realm credentials re-sent to a cross-origin redirect target

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

GHSA-9G45-5XWM-F3WC RMCP: Custom HTTP headers leak to cross-origin redirect targets

Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...

EUVD-2026-81266

RMCP: Custom HTTP headers leak to cross-origin redirect targets...

RMCP: Custom HTTP headers leak to cross-origin redirect targets

Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...

Linux Distros Unpatched Vulnerability : CVE-2026-64684

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in...

CVE-2026-85717: Exposure of Sensitive Information to an Unauthorized Actor

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.14.5 to 2.16.0 and from 3.0.9 to 3.0.11, a client configured with a client-wide Realm and redirect following can disclose credentials after a cross-origin...

CVE-2026-93383: Exposure of Sensitive Information to an Unauthorized Actor

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

EulerOS 2.0 SP15 : perl-libwww-perl (EulerOS-SA-2026-3790)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects.x000D x000D On...

CVE-2026-93387: Improper Check for Unusual or Exceptional Conditions

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: High...

EulerOS 2.0 SP15 : perl-libwww-perl (EulerOS-SA-2026-3815)

According to the versions of the perl-libwww-perl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross- origin redirects.x000D x000D On...