CVE-2026-103030: Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, diohttp2adapter follows redirects in Http2Adapter.fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dio_http2_adapterto a version that resolves this vulnerability.Fixed in 2.8.0
Event History
Frequently Asked Questions
Are applications affected under the default redirect configuration?
Yes. Redirect following is enabled by default, so applications using Http2Adapter for authenticated requests can be affected without separately enabling redirects.
What does an attacker need to exploit this issue?
An attacker needs to control, or cause the application to contact, a server that returns a redirect to a different origin. The redirected destination can then receive sensitive headers preserved from the original request.
Which credentials or headers may be disclosed?
Authorization, Cookie, and Proxy-Authorization headers may be sent to the cross-origin redirect destination. Other headers are also retained because the full original header map is copied.
What can be done if upgrading is not immediately possible?
Disable redirect following for authenticated requests, or avoid using Http2Adapter for requests that carry sensitive headers. Do not allow untrusted servers to control redirect responses for such requests.
Which versions require remediation?
Versions from 1.0.0 up to, but not including, 2.8.0 are affected. Upgrade to version 2.8.0, which contains the fix.