Information Exposure Affecting hubuum_client package, versions >=0.0.1 <0.6.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-HUBUUMCLIENT-18307429
- published25 Jul 2026
- disclosed24 Jul 2026
- creditUnknown
Introduced: 24 Jul 2026
New CVE NOT AVAILABLE CWE-200 (opens in a new tab)How to fix?
Upgrade hubuum_client to version 0.6.1 or higher.
Overview
Affected versions of this package are vulnerable to Information Exposure via the redirect handling process. An attacker can access sensitive authorization headers by influencing a 3xx redirect response to a different path on the same origin, causing the header to be sent outside the intended path prefix. This is only exploitable if an attacker, compromised server, or intermediary can control redirect responses, and the origin is shared with other applications.
Workaround
This vulnerability can be mitigated by constructing a reqwest client with reqwest::redirect::Policy::none() and passing it through with_http_client, or by ensuring the origin is not shared with other applications and trusted infrastructure does not redirect API requests outside the configured path prefix.