56 matches found
CVE-2026-95623
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...
CVE-2026-95623 Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...
CVE-2026-95623 Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...
CVE-2026-95623: Server-Side Request Forgery (SSRF)
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the new target URL against the scope. This...
SUSE CVE-2026-64684
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...
RMCP: Custom HTTP headers leak to cross-origin redirect targets
Summary The rmcp crate's StreamableHttpClientTransport forwards caller-supplied custom HTTP headers such as X-API-Key, X-Auth-Token, Api-Key to cross-origin redirect targets. The defaulthttpclient function builds a reqwest::Client without a redirect policy override, so the default limited10 polic...
CVE-2026-64684: Exposure of Sensitive Information to an Unauthorized Actor
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamablehttpclient.rs builds its defaulthttpclient with reqwest's automatic redirect policy and applies caller-supplied values...
PT-2026-67599
Impact The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on...
PT-2026-67620
Summary When an application configures hubuum client with ClientBuilder::with transport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes,...
RUSTSEC-2026-0169 surf is unmaintained
The surf crate is unmaintained, and all versions are affected. For alternatives, consider using reqwest or ureq. See this issue for more context...
surf is unmaintained
The surf crate is unmaintained, and all versions are affected. For alternatives, consider using reqwest or ureq. See this issue for more context...
PT-2026-49130
The surf crate is unmaintained, and all versions are affected. For alternatives, consider using reqwest or ureq. See this issue for more context...
CVE-2026-45310: Server-Side Request Forgery (SSRF)
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetchurl tool validates the initial URL's resolved IP address against a restricted-IP blocklist isrestrictedip to prevent SSRF attacks against internal services cloud metadata endpoints, localhost, private networks...
[SECURITY] Fedora 44 Update: rust-reqsign-http-send-reqwest-4.0.0-1.fc44
Reqwest-based HTTP client implementation for reqsign...
[SECURITY] Fedora 44 Update: rust-astral-reqwest-retry-0.9.1-1.fc44
Retry middleware for reqwest...
[SECURITY] Fedora 44 Update: rust-astral-reqwest-middleware-0.5.1-1.fc44
Wrapper around reqwest to allow for client middleware chains...
[SECURITY] Fedora 42 Update: rust-gst-plugin-reqwest-0.13.3-4.fc42
GStreamer reqwest HTTP Source Plugin...
[SECURITY] Fedora 41 Update: rust-reqsign-http-send-reqwest-2.0.1-1.fc41
Reqwest-based HTTP client implementation for reqsign...