CVE-2026-7017: HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets
CVE-2026-7017 is a vulnerability in HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets, rated Important by Microsoft, with a CVSS 3.1 base score of 7.1 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.36% probability of exploitation activity in the next 30 days, higher than 30% of all scored vulnerabilities. Microsoft released the fix on 3 November 2026, outside Patch Tuesday. It affects 1 product in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-7017
- Severity
- High CVSS 7.1
- Microsoft severity
- Important
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-522
- EPSS
- 0.36% (percentile 30%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- July 2026 Patch Tuesday
- Product families
- Open Source Software
CVSS score and vector
Microsoft scores CVE-2026-7017 at 7.1 (temporal 7.1) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | Low |
| Availability impact | None |
Affected products (1)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 perl 5.38.2-517 on Azure Linux 3.0 | Release Notes | Security Update |
NIST NVD data
- NVD status
- Deferred
- NVD CVSS
- 7.1 (HIGH)
- NVD weakness
- CWE-522
- Published to NVD
- NVD last modified
References
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch
- https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36
- https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes
- http://www.openwall.com/lists/oss-security/2026/07/07/13
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |