CVE-2026-103030
Received Received - Intake

HTTP/2 Header Injection in Dio HTTP Client

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: GitHub, Inc.

Description
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-103030
EUVD
EUVD-2026-98921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cfug dio >= 1.0.0, < 2.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dio is a HTTP client for Dart and Flutter. The vulnerability exists in the dio_http2_adapter library versions 1.0.0 to 2.8.0. When following redirects, the adapter copies original request headers including sensitive ones like Authorization and Cookie into redirected requests without checking if the source and destination origins match. This allows a server to redirect authenticated requests to a different origin, potentially exposing sensitive headers.

Detection Guidance

Detecting this vulnerability requires checking if your application uses dio_http2_adapter versions before 2.8.0 and if Http2Adapter is configured for authenticated requests with redirect following enabled. Inspect your project dependencies for dio_http2_adapter versions below 2.8.0. Check application logs for cross-origin redirects involving Authorization, Cookie, or Proxy-Authorization headers.

Impact Analysis

If you use Dio with Http2Adapter for authenticated requests and redirect following is enabled, an attacker controlling a server could redirect your requests to their own domain. This could expose sensitive headers like Authorization tokens or cookies, allowing the attacker to impersonate you or access your data.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations if sensitive data is exposed through header leakage during redirects.

Mitigation Strategies

Upgrade dio_http2_adapter to version 2.8.0 or later to patch the vulnerability. If upgrading is not immediately possible, disable redirect following in Http2Adapter or avoid using Http2Adapter for authenticated requests until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103030. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart