Fedora 44 perl-libwww-perl Critical Credentials Leak Fix CVE-2026-8368

The libwww-perl collection is a set of Perl modules which provides a simple and

consistent application programming interface to the World-Wide Web. The main

focus of the library is to provide classes and functions that allow you to

write WWW clients. The library also contain modules that are of more general

use and even classes that help you implement simple HTTP servers.

Changes: 6.83 2026-05-12 11:41:48Z - LWP::UserAgent now strips Authorization and Proxy-Authorization headers on cross-origin redirects (a different scheme, host, or port) to prevent credential leakage to the redirect target. Same-origin redirects retain credentials. Opt out with allow_credentialed_redirects => 1. CVE-2026-8368 reported by Kai Zen; PoC and initial patch by Stig Palmquist. - LWP::UserAgent now refuses https to http redirects by default to prevent leaking remaining request headers and bodies over plaintext. Opt in with allow_downgrade => 1. Related hardening alongside CVE-2026-8368; PoC by Stig Palmquist.