An update for perl-HTTP-Tiny is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3169 Final 1.0 1.0 2026-07-24 Initial 2026-07-24 2026-07-24 openEuler SA Tool V1.0 2026-07-24 perl-HTTP-Tiny security update An update for perl-HTTP-Tiny is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4 This is a very simple HTTP/1.1 client, designed for doing simple requests without the overhead of a large framework like LWP::UserAgent. Security Fix(es): HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller.(CVE-2026-7017) An update for perl-HTTP-Tiny is now available for openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1,openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High perl-HTTP-Tiny https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3169 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-7017 https://nvd.nist.gov/vuln/detail/CVE-2026-7017 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 perl-HTTP-Tiny-0.080-4.oe2203sp4.noarch.rpm perl-HTTP-Tiny-help-0.080-4.oe2203sp4.noarch.rpm perl-HTTP-Tiny-0.088-3.oe2403sp1.noarch.rpm perl-HTTP-Tiny-help-0.088-3.oe2403sp1.noarch.rpm perl-HTTP-Tiny-0.088-3.oe2403sp3.noarch.rpm perl-HTTP-Tiny-help-0.088-3.oe2403sp3.noarch.rpm perl-HTTP-Tiny-0.088-3.oe2403sp4.noarch.rpm perl-HTTP-Tiny-help-0.088-3.oe2403sp4.noarch.rpm perl-HTTP-Tiny-0.076-6.oe2003sp4.noarch.rpm perl-HTTP-Tiny-help-0.076-6.oe2003sp4.noarch.rpm perl-HTTP-Tiny-0.080-4.oe2203sp4.src.rpm perl-HTTP-Tiny-0.088-3.oe2403sp1.src.rpm perl-HTTP-Tiny-0.088-3.oe2403sp3.src.rpm perl-HTTP-Tiny-0.088-3.oe2403sp4.src.rpm perl-HTTP-Tiny-0.076-6.oe2003sp4.src.rpm HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire. The HTTP::Tiny POD note that "Authorization headers will not be included in a redirected request" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller. 2026-07-24 CVE-2026-7017 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 High 7.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N perl-HTTP-Tiny security update 2026-07-24 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3169