CVE-2026-48856

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards the Authorization and Proxy-Authorization request headers to redirect targets without checking whether the redirect crosses an origin boundary. httpc_response:redirect/2 constructs the redirected request by updating only the host field of the header record; all other fields (including authorization and proxy_authorization) are copied verbatim. The redirect target host is never compared against the original host. autoredirect defaults to true, so this affects all httpc callers that do not explicitly disable automatic redirects. An attacker who controls a server that the victim contacts via httpc can issue a cross-origin 3xx redirect to a server they also control. The Authorization header (including Basic credentials derived from URL userinfo via httpc_request:handle_user_info/2) is forwarded to the redirect target, allowing credential theft. The same applies to the Proxy-Authorization header. This vulnerability is associated with program files lib/inets/src/http_client/httpc_response.erl. This issue affects OTP from OTP 17.0 before OTP 29.0.2, OTP 28.5.0.2 and OTP 27.3.4.13, corresponding to inets from 5.10 before 9.7.1, 9.6.2.2 and 9.3.2.6.

• CWE-601

• https://cna.erlef.org/cves/CVE-2026-48856.htmlMitigation, Third Party Advisory
• https://github.com/erlang/otp/commit/688d748d6f7a6a06b13b662a1d3de8af97079612Patch
• https://github.com/erlang/otp/security/advisories/GHSA-m75x-4vwg-ggjhMitigation, Vendor Advisory
• https://osv.dev/vulnerability/EEF-CVE-2026-48856Mitigation, Third Party Advisory
• https://www.erlang.org/doc/system/versions.html#order-of-versionsProduct

Published

Jun 10, 2026

Last Modified

Jul 24, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-48850PuTTY 0.72 before 0.84 has a double free in RSA KEX.5.9
• CVE-2026-48851PuTTY 0.77 before 0.84 uses a copy of the PuTTY icon as a tr…3.1
• CVE-2026-48852PuTTY 0.71 before 0.84 has an assertion failure in ECDSA sig…3.7
• CVE-2026-48853Deserialization of Untrusted Data and Allocation of Resource…9.2
• CVE-2026-48854Allocation of Resources Without Limits or Throttling vulnera…8.7
• CVE-2026-48855Exposure of Sensitive Information to an Unauthorized Actor v…6.5
• CVE-2026-48858Server-Side Request Forgery (SSRF) vulnerability in Erlang/O…6.5
• CVE-2026-48859Observable Timing Discrepancy vulnerability in Erlang/OTP ss…5.3
• CVE-2026-48860Reliance on IP Address for Authentication vulnerability in E…6.5
• CVE-2026-48861Improper Neutralization of CRLF Sequences ('CRLF Injection')…2.1
• CVE-2026-48862Allocation of Resources Without Limits or Throttling vulnera…8.2
• CVE-2026-48863A flaw was found in libsolv. A stack-based buffer overflow v…7.5