CVE-2026-61308

A flaw was found in OpenJDK. This vulnerability leads to information disclosure because the java.net.HttpURLConnection networking component does not remove Proxy-Authorization headers during cross-host HTTP (Hypertext Transfer Protocol) redirects. A remote attacker controlling a web server can redirect a client application to an untrusted host, capturing sensitive proxy authentication credentials.

This vulnerability is rated as Moderate severity for Red Hat because successful credential leakage requires a Java client application to explicitly authenticate through an HTTP proxy while automatically following redirects to untrusted destinations. In typical Red Hat deployments, background enterprise workloads either communicate with trusted endpoints or disable automatic redirection handling, limiting general exposure. Because exploitation necessitates specific proxy-based client workflows and interaction with malicious servers rather than providing direct remote code execution, overall risk to system integrity remains constrained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.