Cross-origin redirect leaks sensitive headers in Dio HTTP/2 adapter
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The dio_http2_adapter package for Dart from 1.0.0 before 2.8.0 keeps the original request headers when it follows a redirect to a different origin. A server that an application contacts can return a cross-origin Location redirect, and the destination receives Authorization, Cookie and Proxy-Authorization headers (CWE-200). The issue affects authenticated requests made through Http2Adapter, and redirect following is enabled by default.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| cfug | dio | 1.0.0 to before 2.8.0 | 2.8.0 | Patch available | CNA |
| — | dio_http2_adapter (Pub) | 1.0.0 to before 2.8.0 | 2.8.0 | Patch available | GHSA-cr65-55v9-xhvv |
- dio Vendorcfug Affected 1.0.0 to before 2.8.0 Fixed in 2.8.0 Patch available CNA
- dio_http2_adapter (Pub) Vendor— Affected 1.0.0 to before 2.8.0 Fixed in 2.8.0 Patch available GHSA-cr65-55v9-xhvv
Remediation
Upgrade dio_http2_adapter to version 2.8.0. The sources list no fixed version for dio.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA dio (cfug) Fixed in 2.8.0
- Fix · GHSA-cr65-55v9-xhvv dio_http2_adapter (Pub) Fixed in 2.8.0 Advisory →
Timeline
- 2026-10-13 Threatist record created from CVE-2026-103030
- 2026-10-16 Alias added: GHSA-cr65-55v9-xhvv
- 2026-10-16 Fix available: Pub/[email protected] · GHSA-cr65-55v9-xhvv
- 2026-10-16 CVSS score added · GHSA-cr65-55v9-xhvv
- 2026-10-16 Weakness changed · GHSA-cr65-55v9-xhvv
- 2026-10-16 5 new references · GHSA-cr65-55v9-xhvv
References
Sources
- CVE-2026-103030 · CVE Program
- CVE-2026-103030 · NVD
- FIRST EPSS
- GHSA-cr65-55v9-xhvv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences