https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T18:31:30.303083+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-44503 CVE-2026-44503 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect 2026-10-01T18:31:30.304574+00:00

Affected: microsoft kiota-java, Microsoft.Kiota.Abstractions, microsoft github.com/microsoft/kiota-http-go, microsoft kiota-typescript, microsoft-kiota-abstractions, microsoft-kiota-http

The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.