AIKIDO-2026-571839
dio_http2_adapter is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
75
High Risk
This Affects:
dio_http2_adapterTL;DR
The HTTP/2 adapter for the dio client copies all original request headers onto the follow-up request when it handles a redirect response. Because it does not compare the redirect target origin against the original origin, sensitive headers such as authorization, cookie, and proxy-authorization are forwarded to a different host. A redirect response from an untrusted server can therefore cause authentication credentials to be disclosed to that host. The fix strips these sensitive headers when a redirect crosses an origin boundary.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application sends requests carrying sensitive headers such as authorization or cookie while following redirects.
Background info
dio_http2_adapter is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 1.0.0 - 2.7.1.
How to fix this
Upgrade the dio_http2_adapter library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant