What’s Vulnerable › Vulnerabilities

CVE-2022-31033: Authorization header leak in rubygem Mechanize

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-09 · updated 2026-06-17
• Weakness: CWE-200

Description

The Mechanize library is used for automating interaction with websites. Mechanize automatically stores and sends cookies, follows redirects, and can follow links and submit forms. In versions prior to 2.8.5 the Authorization header is leaked after a redirect to a different port on the same site. Users are advised to upgrade to Mechanize v2.8.5 or later. There are no known workarounds for this issue.

Affected products

• Fedoraproject Fedora: 35, 36
• python-mechanize mechanize: before 2.8.5 — fixed in 2.8.5

How to fix

Upgrade to a fixed version: python-mechanize mechanize 2.8.5. Check the vendor advisory for mitigations.

References

• https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317
• https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA2FJROTX2U6EBWDPKRQ2VAM67A5TQXF/
• https://github.com/sparklemotion/mechanize/commit/c7fe6996a5b95f9880653ba3bc548a8d4ef72317
• https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OKZMR5O3T5HQ2V737TC7IU4WZRT2LGX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OA2FJROTX2U6EBWDPKRQ2VAM67A5TQXF/

Get alerted when CVE-2022-31033 or the next vulnerability affects your stack