CVE-2026-103030
Dio: Cross-origin redirect leaks sensitive request headers in
Published Oct 13, 2026 · corrected/updated Oct 15, 2026 · cfug dio · evidence confidence high
### Summary follows HTTP redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin redirect receives the victim's , , and headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because is enabled by default, no authentication is required to exploit it, and the confidentiality impact is high. ### Details When is configured to use , the adapter's internal method constructs HTTP/2 request headers by unconditionally copying all entries from : On receiving a response, the adapter reads the header and resolves the redirect target URI: is called without an explicit argument; therefore preserves the full original header map via . ( ) returns an attacker-controlled cross-origin URI without any origin comparison. The combination means that on every redirect, the full set of original sensitive headers — including , , and — is forwarded to the new authority with no sanitization. **Data flow (source → sink):** 1. — public entry point. 2. — base and per-request headers merged into . 3. — dispatches to . 4. — header is read from the network response (attacker-controlled source). 5. — redirect target URI resolved; cross-origin check absent. 6. — called without override. 7. — preserves — all sensitive headers retained. 8. — preserved headers emitted verbatim to the cross-origin HTTP/2 request (sink). **Suggested patch** — strip sensitive headers before following a cross-origin redirect: ### PoC The following steps reproduce the vulnerability using two local HTTP/2 cleartext (h2c) servers inside an isolated Docker container (no external network required). **Prerequisites:** - Docker installed and accessible. - Repository checked out at the path used as the build context. **Build and run:** **What the container does:** 1. Starts an *origin* h2c server on that immediately returns . 2. Starts an *attacker* h2c server on that logs every received head
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-103030 is a high public vulnerability record for cfug dio. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether cfug dio is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: dio_http2_adapter (1.0.0 → 2.8.0); dio_http2_adapter (>= 1.0.0, <= 2.7.1); cfug dio. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: CVSS 7.5, EPSS 0.4%. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-200. Sources contributing to this record: cve_org, epss, github, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
### Summary follows HTTP redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin redirect receives the victim's , , and headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because is enabled by default, no authentication is required to exploit it, and the
Oct 15, 2026 · GitHub Advisory Database
Fix available
dio_http2_adapter fixed in 2.8.0
Oct 15, 2026 · GitHub Advisory Database
Fix available
dio_http2_adapter fixed in 2.8.0
Oct 15, 2026 · GitHub Advisory Database
Updated
### Summary follows HTTP redirects without stripping sensitive request headers when the redirect target is a different origin. An attacker who can cause any origin server to return a cross-origin redirect receives the victim's , , and headers verbatim. This vulnerability has a CVSS v3.1 base score of **7.5 (High)** because is enabled by default, no authentication is required to exploit it, and the
Affected
- Pub dio_http2_adapter1.0.0 → 2.8.0
- pub dio_http2_adapter>= 1.0.0, <= 2.7.1
- vendor cfug dioversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-103030
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server
cve.org - FIRST EPSSExploitation probabilityCVE-2026-103030
30-day exploitation probability 0.4%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-cr65-55v9-xhvv
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devPackage advisoryGHSA-cr65-55v9-xhvv
Dio: Cross-origin redirect leaks sensitive request headers in
osv.dev