CVE-2026-8368

Name	CVE-2026-8368
Description	LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1136449

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libwww-perl (PTS)	bullseye	6.52-1	vulnerable
	bookworm	6.68-1	vulnerable
	trixie	6.78-1	vulnerable
	forky, sid	6.83-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libwww-perl	source	(unstable)	6.83-1			1136449

Notes

[trixie] - libwww-perl <no-dsa> (Minor issue)
[bookworm] - libwww-perl <no-dsa> (Minor issue)
[bullseye] - libwww-perl <postponed> (Minor issue, credentials leak in uncommon scenario)
https://lists.security.metacpan.org/cve-announce/msg/39974665/
https://github.com/libwww-perl/libwww-perl/pull/512
https://github.com/libwww-perl/libwww-perl/pull/284
Fixed by: https://github.com/libwww-perl/libwww-perl/commit/9c4aeb6f2dd32f2b7eaf2d7827cade31ea6cb2c6 (v6.83)