HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.

According to the versions of the perl-HTTP-Tiny packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.

    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire.

    The HTTP::Tiny POD note that 'Authorization headers will not be included in a redirected request' applied     only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.(CVE-2026-7017)

    HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field     header values.

    The unvalidated inputs are the method and URI in the request line, the URL host that becomes the `Host:`     header, and HTTP/1.1 control data field values.

    An attacker who controls one of these inputs, for example a user supplied URL passed to a webhook or URL     fetch endpoint, can inject additional headers and smuggle requests to the upstream server.(CVE-2026-7010)

Tenable has extracted the preceding description block directly from the EulerOS perl-HTTP-Tiny security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21529-1 advisory.

    Changes in perl-HTTP-Tiny:

    - updated to 0.096
    - CVE-2026-7017: Fixed forwarded credential headers to cross-origin redirect targets (bsc#1271020)
    - Caller-supplied Authorization, Cookie, and Proxy-Authorization       headers are now stripped on cross-origin redirects by default. Use       allow_credentialed_redirects to opt out.
    - Redirects are no longer automatically followed when going from https to http.
      Use allow_downgrade to revert to the original behaviour.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0610 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-7017:
    HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
    When the server returns a 3xx redirect, _maybe_redirect follows the Location: header and
    _prepare_headers_and_cb re-merges the caller's headers argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied Authorization, Cookie     and Proxy-Authorization headers are therefore re-sent to whatever host the redirect names, across scheme,     host or port boundaries, and including https to http downgrades that expose them in plaintext on the wire.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.
    When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and     `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking     whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`,     `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names,     across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in     plaintext on the wire. The HTTP::Tiny POD note that Authorization headers will not be included in a     redirected request applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by     the caller. (CVE-2026-7017)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343687	EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3294)	Nessus	Huawei Local Security Checks	Local	high
343674	EulerOS 2.0 SP12 : perl-HTTP-Tiny (EulerOS-SA-2026-3369)	Nessus	Huawei Local Security Checks	Local	high
333006	openSUSE 16 Security Update : perl-HTTP-Tiny (openSUSE-SU-2026:21529-1)	Nessus	SuSE Local Security Checks	Local	high
328387	TencentOS Server 4: perl-HTTP-Tiny (TSSA-2026:0610)	Nessus	Tencent Local Security Checks	Local	high
325549	Linux Distros Unpatched Vulnerability : CVE-2026-7017	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-7017

high

Tenable Plugins

high

high

high

high

high