CWE-319 Cleartext Transmission of Sensitive Information

AsyncHttpClient: WebSocket proxy credentials sent to the origin server over a CONNECT tunnel

AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host

AsyncHttpClient: Digest challenge without a usable nonce downgrades to Basic and sends the password in cleartext

AsyncHttpClient sends origin credentials to the proxy on the plaintext CONNECT request

rclone: http backend forwards custom/auth headers to a different host on redirect

HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies

Apache Airflow FTP provider: FTP Provider does not protect FTPS data channel (missing PROT_P)

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

Withdrawn Advisory: Open WebUI/ZDI-CAN-28259

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

org.mariadb:r2dbc-mariadb vulnerable to cleartext password disclosure to a man-in-the-middle server (clear-text auth plugins not gated on a secure transport)

org.mariadb.jdbc:mariadb-java-client has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

MariaDB has Cleartext Transmission of Sensitive Information and Insufficiently Protected Credentials

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

rclone: S3 backend does not strip X-Amz-Security-Token on a same-host HTTPS->HTTP redirect

rclone: WebDAV Credentials Survive a Same-Host HTTPS-to-HTTP Redirect

rclone: S3 Redirect Sanitization Omits IBM IAM Bearer Tokens and SSE-C Keys

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake

GoFiber never set HSTS header in helmet middleware due to incorrect protocol check

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

guzzlehttp/guzzle: Silent HTTPS-Proxy Downgrade to Cleartext

@hapi/wreck: Sensitive credential headers leak across cross-port and cross-scheme redirects

Couchbase Sync Gateway shows cleartext passwords in redacted and unredacted output