Threats tagged 'brew-jupyterlab-cve-2026-49853'

CVE-2026-49853 is a vulnerability in Tornado's SimpleAsyncHTTPClient where the Authorization header is forwarded across cross-origin redirects. This occurs because when following 3xx redirects, the client does not clear authorization-related headers if the redirect target changes origin, potentially leaking credentials to unintended domains. The issue affects versions from 1.2.0 up to but not including 4.5.8. A fix is available starting in version 4.5.8, which aligns the behavior with libcurl by removing Authorization and Cookie headers on cross-origin redirects.