Search: CVE-2026-57210

Heimdall versions prior to 0.17.17 improperly validate client IP addresses extracted from Forwarded and X-Forwarded-For headers when the trusted_proxies option is configured. The service accepts arbitrary strings, malformed IP literals, and unknown or obfuscated identifiers without proper syntax validation. Additionally, the Forwarded header parser incorrectly splits quoted strings, potentially causing malformed parsing of client IP addresses. This vulnerability was fixed in version 0.17.17.