When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value.
Sending the same set of headers to subsequent hosts is a problem as this header often contains privacy sensitive information or data that could allow others to impersonate the client's request.
This issue has been patched in release 6.8.3
None.
{
"github_reviewed_at": "2026-03-18T20:07:49Z",
"github_reviewed": true,
"cwe_ids": [
"CWE-200"
],
"nvd_published_at": null,
"severity": "CRITICAL"
}