Score 6.5 from GitHub Security Advisory published 2026-05-12. NVD baseline CVSS 6.5; sources differ by 0.0.
A fix is available — apply it.
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.
On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes.
A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
May 12, 2026
May 19, 2026
Upstream fix in progress (PR #284 · libwww-perl/libwww-perl, state=closed)
https://github.com/libwww-perl/libwww-perl/pull/284These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects
LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers...
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| ubuntu | libwww-perl (6.81-1ubuntu0.1) @ resolute | 2026-08-23 | ubuntu |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| libwww-perl | 6.52-1 ... 6.83-1 (25 versions) | — | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| libwww-perl | 6.68-1 ... 6.83-1 (13 versions) | — | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| libwww-perl | 6.78-1, 6.80-1, 6.81-1, 6.82-1, 6.83-1 | — | — |
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| libwww-perl | 6.78-1, 6.80-1, 6.81-1, 6.82-1 | 6.83-1 | — |
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
Showing the most recent 100 of 215 total refreshes for this CVE.
CWE-522
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-8368
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.