https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T10:40:28.506744+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-25680 CVE-2026-25680 — Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html 2026-10-02T10:40:28.556215+00:00

Affected: golang.org/x/net/html

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

 https://cve.radiocsirt.org/vuln/ghsa-7j59-v9qr-6fq9 GHSA-7j59-v9qr-6fq9 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect 2026-10-02T10:40:28.556286+00:00

Affected: Maven: com.microsoft.kiota:microsoft-kiota-abstractions, NuGet: Microsoft.Kiota.Abstractions, PyPI: microsoft-kiota-http, npm: kiota-typescript, Go: github.com/microsoft/kiota-http-go

### Summary The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

### Details Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

``` boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme()); boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString()); if (!sameScheme || !sameHost) { requestBuilder.removeHeader("Authorization"); // BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed } ```

### PoC 1. Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota…