Summary
Hubuum client library (Rust): Authenticated requests may escape the configured base path through redirects
Workarounds
On affected versions, construct a reqwest client with reqwest::redirect::Policy::none() and pass it through with_http_client. Deployments can also reduce exposure by ensuring the Hubuum origin is not shared with other applications and that trusted infrastructure never redirects API requests outside the configured path prefix.
Impact
The built-in async and blocking clients used reqwest's default redirect policy. BaseUrl constrains the initial request to the configured origin and path prefix, but redirect processing occurs after that validation. reqwest retains sensitive headers when a redirect changes only the path on the same scheme, host, and port. A redirect from a Hubuum endpoint to another path on a shared origin could therefore carry the bearer Authorization header outside the configured Hubuum path prefix.
Exploitation requires an attacker, compromised server, or intermediary to influence a 3xx response. Cross-origin redirects are not affected because reqwest strips sensitive headers when scheme, host, or port changes.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Version 0.6.1 configures both built-in HTTP clients with reqwest::redirect::Policy::none(). Redirect responses are returned as 3xx API errors instead of being followed. Supplying a preconfigured reqwest client remains an explicit opt-in to that client's redirect policy.
Frequently Asked Questions
- What is GHSA-F45Q-W629-WR25? GHSA-F45Q-W629-WR25 is a medium-severity security vulnerability in hubuum_client (rust), affecting versions >= 0.0.1, < 0.6.1. It is fixed in 0.6.1.
- Which versions of hubuum_client are affected by GHSA-F45Q-W629-WR25? hubuum_client (rust) versions >= 0.0.1, < 0.6.1 is affected.
- Is there a fix for GHSA-F45Q-W629-WR25? Yes. GHSA-F45Q-W629-WR25 is fixed in 0.6.1. Upgrade to this version or later.
- Is GHSA-F45Q-W629-WR25 exploitable, and should I be worried? Whether GHSA-F45Q-W629-WR25 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether GHSA-F45Q-W629-WR25 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix GHSA-F45Q-W629-WR25? Upgrade
hubuum_clientto 0.6.1 or later.