CVE-2009-2062: Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which al...

Security readout for executives and security teams

CVE-2009-2062 is an old Apple Safari flaw affecting versions before 3.2.2. A network attacker positioned between the user and site could interfere with an HTTPS CONNECT redirect and cause script to run in the trusted HTTPS site context. Business risk is mainly legacy-browser exposure. Exposure is likely limited to systems still using Apple Safari versions before 3.2.2 or environments preserving very old browser stacks. The bundle does not identify modern affected products, CPEs, or platform versions. Treat this as a legacy exposure issue. It is not supported by KEV evidence of active exploitation, but outdated Safari use in sensitive workflows should be eliminated because the flaw undermines HTTPS trust assumptions. Mitigation focus: Retire or upgrade any Safari installation older than 3.2.2.; Check Apple or vendor guidance for historical patch applicability.; Remove unsupported browsers from managed endpoints..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.