CVE-2016-6287: Call-Cc HTTP-Client

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI process. Under several web servers this would mean a user-supplied "Proxy" header could allow an attacker to direct all HTTP requests through a proxy (also known as a "httpoxy" attack). This affects all versions of http-client before 0.10.

Affected products

• Call-Cc HTTP-Client: up to and including 0.9

Published 2017-01-10. Last modified 2026-06-17.