CVE-2026-103030 Details
Description
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
A vulnerability exists in the dio_http2_adapter for the Dio HTTP client in Dart and Flutter, specifically in versions 1.0.0 prior to 2.8.0. The issue arises because the adapter follows HTTP redirects without properly sanitizing sensitive headers such as Authorization and Cookie when the redirect crosses origin boundaries. This flaw allows an attacker to intercept these headers by directing a victim's application to an attacker-controlled server via a cross-origin redirect.
Users can update to dio_http2_adapter version 2.8.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/cfug/dio/security/advisories/GHSA-cr65-55v9-xhvv | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/cfug/dio/commit/9d7ac913340084f3b4987b121e076f28d637a81e | [email protected] | Source CodeVendor |
| https://github.com/cfug/dio/releases/tag/http2_adapter_v2.8.0 | [email protected] | Release NotesVendor |
| https://github.com/cfug/dio/security/advisories/GHSA-cr65-55v9-xhvv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cfug Dio | All versions |
CPE
Remediation
| |
| cfug dio_http2_adapter | >= 1.0.0, <= 2.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |