PyPI/microsoft-kiota-http CVE-2026-44503: high 7, EPSS 0.64%

Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect

Action: Upgrade microsoft-kiota-http to 1.9.9 or later.

pip install microsoft-kiota-http==1.9.9

Affected

Fixed versions

Sources

• osv: GHSA-7j59-v9qr-6fq9
• nvd: CVE-2026-44503
• https://github.com/microsoft/kiota-java/security/advisories/GHSA-7j59-v9qr-6fq9
• https://github.com/advisories/GHSA-7j59-v9qr-6fq9
• https://github.com/microsoft/kiota-java
• https://github.com/pypa/advisory-database/tree/main/vulns/microsoft-kiota-http/PYSEC-2026-2647.yaml
• https://pypi.org/project/microsoft-kiota-http

CVE-2026-44503 · published 2026-05-07T01:49:01Z · modified 2026-09-10T03:50:46.498025328Z · JSON