CVE-2026-100724

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

View on CVE.org
Published Sep 27, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.

Analysis

AI-generated

Technical impact

The vulnerability in http4k occurs when the reverseProxy() and reverseProxyRouting() functions perform substring matching on the Host header. An attacker sending a Host header that only contains a configured virtual host name can be routed to that host, bypassing any routing‑based authorization. This allows the attacker to gain unintended access to protected application paths that are meant to be restricted to specific virtual hosts.

Affected Systems

The issue affects the http4k library (org.http4k:http4k-core) in versions prior to 6.49.0.0, 5.42.0.0, and 4.51.0.0. These versions are commonly used in server‑side applications that expose reverseProxy handlers to the internet.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote HTTP requests; any inbound request that reaches a reverseProxy handler configured with multiple virtual hosts is potentially exploitable. While no public exploits are reported, the impact—bypassing routing‑based access control—is significant enough to warrant prompt action.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade http4k to version 6.49.0.0 or newer (or 5.42.0.0/4.51.0.0 for those specific releases) to remove the substring matching flaw.
  • Reconfigure reverseProxy or reverseProxyRouting to use exact Host header matching, or disable multiple virtual hosts on the same public‑facing inbound handler if such configuration is required.
  • Restrict inbound traffic to the reverseProxy endpoint using network‑level controls (firewalls, VPNs, or ACLs) so that only trusted IPs can reach the vulnerable functionality.

Generated by OpenCVE AI on September 27, 2026 at 03:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Http4k
Http4k http4k
Vendors & Products Http4k
Http4k http4k
Type Values Removed Values Added
Description http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.
Title http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy
Weaknesses CWE-444
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}
Weaknesses
  • CWE-444

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Oct 29, 2026, 9:15 PM
Reserved
Sep 26, 2026, 2:40 AM

View source JSON

Updated
Sep 30, 2026, 3:15 PM

JSON

Status
Deferred
Published
Sep 27, 2026, 2:17 AM
Modified
Oct 29, 2026, 9:17 PM

View source JSON

No data.

Updated
Sep 27, 2026, 3:30 AM

JSON