7.0
Élevée
CVE-2026-44503 The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and…
Description
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| kiota-java 1.9 | premières → < 1.9.1 | 1.9.1 |
| Microsoft.Kiota.Abstractions 1.22 | premières → < 1.22.0 | 1.22.0 |
| github.com/microsoft/kiota-http-go 1.5 | premières → < 1.5.5 | 1.5.5 |
| kiota-typescript 1.0 | premières → < 1.0.0-preview.100 | 1.0.0-preview.100 |
| microsoft-kiota-abstractions 1.9 | premières → < 1.9.1 | 1.9.1 |
| microsoft-kiota-http 1.9 | premières → < 1.9.9 | 1.9.9 |
Références
- github.com github.com
Chronologie
- Publiée
- Dernière modification