7.0
High
CVE-2026-44503 The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and…
Description
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| kiota-java 1.9 | earliest → < 1.9.1 | 1.9.1 |
| Microsoft.Kiota.Abstractions 1.22 | earliest → < 1.22.0 | 1.22.0 |
| github.com/microsoft/kiota-http-go 1.5 | earliest → < 1.5.5 | 1.5.5 |
| kiota-typescript 1.0 | earliest → < 1.0.0-preview.100 | 1.0.0-preview.100 |
| microsoft-kiota-abstractions 1.9 | earliest → < 1.9.1 | 1.9.1 |
| microsoft-kiota-http 1.9 | earliest → < 1.9.9 | 1.9.9 |
References
- github.com github.com
Timeline
- Published
- Last modified