The http4k-core library versions prior to 6.49.0.0, 5.42.0.0, and 4.51.0.0 perform substring (Contains) matching on the Host header by default in the reverseProxy() and reverseProxyRouting() functions when dispatching requests to configured virtual hosts. If deployed as a public-facing inbound HTTP handler with two or more virtual hosts, a remote attacker can craft a Host header containing a configured virtual host name as a substring (e.g., 'admin.evil.com' for a vhost named 'admin') to bypass routing-based authorization and be routed to that virtual host. This flaw does not impact intended outbound dispatch or test-time uses where the Host header is explicitly set by the application.

An attacker can bypass routing-based authorization controls by manipulating the Host header to include a configured virtual host name as a substring, potentially gaining unauthorized access to resources or services bound to that virtual host. The impact is limited to scenarios where reverseProxy() or reverseProxyRouting() are used as public-facing inbound HTTP handlers with multiple virtual hosts configured. Confidentiality and integrity impacts are low, with no availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid deploying reverseProxy() or reverseProxyRouting() with multiple virtual hosts in public-facing inbound HTTP handlers or implement strict exact matching on the Host header to prevent substring-based routing bypass.