Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

seanmonstar/reqwest

              master @ ea3d9ca
            

Fixes

CVEs

HIGH

Peak severity

50.0%

Coverage

Highlights

Broken Cryptography: 1 prior fix. Scrutinize any change in this area.

src/redirect.rs: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Broken Cryptography: Improperly treating raw PEM bytes as DER certificate revocation lists (CRLs) can bypass revocation checks entirely, undermining the integrity of TLS connection verification. This occurs because the parser wraps the raw PEM structure without decoding it to DER.

Information Disclosure: Sensitive request headers such as Authorization and Cookie are leaked when a redirect transitions across security boundaries (specifically, downgrading from HTTPS to HTTP). The redirect handler must strip these headers to prevent credential exposure.