https://seclists.org/oss-sec/2026/q2/494: CVE-2026-8368: LWP::UserAgent versions befo6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin dicts

Q: Who is exposed to credential disclosure?

Applications using LWP::UserAgent from libwww-perl before 6.83 are exposed if they supply Authorization or Proxy-Authorization headers and follow a 3xx redirect. The risk is especially relevant where a redirect can lead to an attacker-controlled host.

Q: What must an attacker control to receive the credentials?

The attacker needs a redirect target under their control. If the client follows a 3xx response to that target, the affected redirect handler can forward caller-supplied Authorization and Proxy-Authorization headers even when the scheme, host, or port changes.

Q: Are credentials removed when the redirect crosses to another origin?

No. Before 6.83, the redirect handler strips only Host and Cookie headers; Authorization and Proxy-Authorization remain on the follow-up request across scheme, host, or port changes.

Q: What is the available remediation?

Upgrade libwww-perl to version 6.83 or later.

Published May 12, 2026

Updated

Affected Software

1 affected component

cpan/libwww-perl<6.83

Frequently Asked Questions

Who is exposed to credential disclosure?

Applications using LWP::UserAgent from libwww-perl before 6.83 are exposed if they supply Authorization or Proxy-Authorization headers and follow a 3xx redirect. The risk is especially relevant where a redirect can lead to an attacker-controlled host.

What must an attacker control to receive the credentials?

The attacker needs a redirect target under their control. If the client follows a 3xx response to that target, the affected redirect handler can forward caller-supplied Authorization and Proxy-Authorization headers even when the scheme, host, or port changes.

Are credentials removed when the redirect crosses to another origin?

No. Before 6.83, the redirect handler strips only Host and Cookie headers; Authorization and Proxy-Authorization remain on the follow-up request across scheme, host, or port changes.

What is the available remediation?

Upgrade libwww-perl to version 6.83 or later.