fkie_cve-2026-103030

Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

GHSA-cr65-55v9-xhvv — Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`

Affected: Pub: dio_http2_adapter

### Summary

`dio_http2_adapter` follows HTTP `Location` redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin `302` redirect receives the victim's `Authorization`, `Cookie`, and `Proxy-Authorization` headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because `followRedirects` is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high.

### Details

When `Dio` is configured to use `Http2Adapter`, the adapter's internal `_fetch` method constructs HTTP/2 request headers by unconditionally copying all entries from `options.headers`:

```dart // plugins/http2_adapter/lib/src/http2_adapter.dart:111 headers.addAll( options.headers.entries.map((entry) { ... return Header.ascii(entry.key.toLowerCase(), v); }).toList(), ); ```

On receiving a `3xx` response, the adapter reads the `Location` header and resolves the redirect target URI:

```dart // plugins/http2_adapter/lib/src/http2_adapter.dart:254-263 final url = responseHeaders.value('location'); final uri = Uri.parse(url ?? ''); final String path = resolveRedirectUri(options.uri, uri).toString(); return _fetch(options.copyWith(path: path, maxRedirects: --options.maxRedirects), ...); ```

`options.copyWith` is called without an explicit `headers` argument; `dio/lib/src/options.dart:629` therefore preserves the full original hea…

Most recent entries from all

fkie_cve-2026-103030

GHSA-cr65-55v9-xhvv — Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`