9 matches found
GHSA-CR65-55V9-XHVV Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Summary diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorizatio...
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Summary diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorizatio...
EUVD-2026-98921
Dio: Cross-origin redirect leaks sensitive request headers in diohttp2adapter...
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
diohttp2adapter follows HTTP Location redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin 302 redirect receives the victim's Authorization, Cookie, and Proxy-Authorization header...
CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...
CVE-2026-103030
The Dio HTTP client for Dart and Flutter contains a vulnerability in the dio_http2_adapter component (versions 1.0.0 through 2.8.0). The root cause is that Http2Adapter._fetch follows redirects by copying the original RequestOptions.headers into the redirected HTTP/2 request without performing cr...
CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...
CVE-2026-103030 Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...
CVE-2026-103030: Exposure of Sensitive Information to an Unauthorized Actor
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an...