The vulnerability in http4k occurs when the reverseProxy() and reverseProxyRouting() functions perform substring matching on the Host header. An attacker sending a Host header that only contains a configured virtual host name can be routed to that host, bypassing any routing‑based authorization. This allows the attacker to gain unintended access to protected application paths that are meant to be restricted to specific virtual hosts.

The issue affects the http4k library (org.http4k:http4k-core) in versions prior to 6.49.0.0, 5.42.0.0, and 4.51.0.0. These versions are commonly used in server‑side applications that expose reverseProxy handlers to the internet.

The CVSS score of 6.3 indicates moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV. The likely attack vector is remote HTTP requests; any inbound request that reaches a reverseProxy handler configured with multiple virtual hosts is potentially exploitable. While no public exploits are reported, the impact—bypassing routing‑based access control—is significant enough to warrant prompt action.