CVE-2026-103030 · GHSA-cr65-55v9-xhvv
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
- Risk score
- 56/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 13 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return …
- Affected
- dio_http2_adapter (pub) >= 1.0.0, <= 2.7.1
- Fix
- Upgrade dio_http2_adapter to 2.8.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
- Remotely exploitable without logging in
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| dio_http2_adapter | pub | >= 1.0.0, <= 2.7.1 | 2.8.0 |
References
- https://github.com/advisories/GHSA-cr65-55v9-xhvv
- https://github.com/cfug/dio/security/advisories/GHSA-cr65-55v9-xhvv
- https://nvd.nist.gov/vuln/detail/CVE-2026-103030
- https://github.com/cfug/dio/commit/9d7ac913340084f3b4987b121e076f28d637a81e
- https://github.com/cfug/dio/releases/tag/http2_adapter_v2.8.0
- https://github.com/advisories/GHSA-cr65-55v9-xhvv
Original description
Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0.
Last activity 13 Oct 2026. Patch Forecast updates every hour.