CVE-2026-2303 — Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

Affected: MongoDB Inc MongoDB Go Driver

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

GHSA-7j59-v9qr-6fq9 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Affected: Maven: com.microsoft.kiota:microsoft-kiota-abstractions, NuGet: Microsoft.Kiota.Abstractions, PyPI: microsoft-kiota-http, npm: kiota-typescript, Go: github.com/microsoft/kiota-http-go

### Summary The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme.

This vulnerability is present in the RedirectHandlers for:

https://github.com/microsoft/kiota-dotnet https://github.com/microsoft/kiota-java https://github.com/microsoft/kiota-python https://github.com/microsoft/kiota-typescript https://github.com/microsoft/kiota-http-go

### Details Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

This is the default middleware in every kiota-java HTTP client created via KiotaClientFactory.create(). OkHttp's built-in redirect handler (which handles this correctly) is explicitly disabled at line 63 of KiotaClientFactory.java in favor of kiota's broken implementation.

Vulnerable code in RedirectHandler.java lines 107-116 (getRedirect method) in versions 1.90 and earlier:

``` boolean sameScheme = locationUrl.scheme().equalsIgnoreCase(requestUrl.scheme()); boolean sameHost = locationUrl.host().toString().equalsIgnoreCase(requestUrl.host().toString()); if (!sameScheme || !sameHost) { requestBuilder.removeHeader("Authorization"); // BUG: Cookie, Proxy-Authorization, and all other headers are NOT removed } ```

### PoC 1. Clone the repository: git clone --depth 1 https://github.com/microsoft/kiota-java.git cd kiota…

Most recent entries from all

CVE-2026-2303 — Heap Out-of-Bounds Read in Go Driver GSSAPI C Wrappers enables application crash or information leak

GHSA-7j59-v9qr-6fq9 — Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect