Cross-Origin Header Exposure in Dio HTTP Client by CFUG
CVE-2026-103030

7.5HIGH

Key Information:

Vendor

Cfug

Status
Dio
Vendor
CVE Published:
13 October 2026

What is CVE-2026-103030?

The Dio HTTP client, utilized in Dart and Flutter applications, has a vulnerability that allows for cross-origin header exposure during HTTP/2 redirects. Versions from 1.0.0 to 2.8.0 improperly handle header preservation when following redirects. This can result in sensitive information, such as Authorization, Cookie, and Proxy-Authorization headers, being sent to unintended cross-origin destinations. This issue is mitigated in version 2.8.0, where the header copying mechanism was updated to ensure that the source and destination origins are checked before forwarding potentially sensitive headers.

Affected Version(s)

dio >= 1.0.0, < 2.8.0

References

https://github.com/cfug/dio/security/advisories/GHSA-cr65...
x_refsource_CONFIRM
https://github.com/cfug/dio/commit/9d7ac913340084f3b4987b...
x_refsource_MISC
https://github.com/cfug/dio/releases/tag/http2_adapter_v2...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.