CVE-2026-110723 affects the Eclipse Connected Services Platform's api-gateway component in versions 1.1.1 through 1.7.3. The default rate-limit key resolver uses the leftmost element of the X-Forwarded-For header to identify clients, but this header value is not validated against trusted proxies. This allows an attacker to bypass rate limiting by supplying unique header values, effectively obtaining unlimited independent rate-limit buckets.
Monkeytype is a minimalistic and customizable typing test. In 26.26.0 and earlier, the backend rate-limit key generator in backend/src/middlewares/rate-limit.ts uses client-controlled cf-connecting-ip and x-forwarded-for headers before the trust-proxy-derived req.ip value. An unauthenticated attacker can rotate either header to create a new bucket for each request, bypassing rootRateLimiter, badAuthRateLimiter, getKey(), and the getKeyWithUid() fallback used by public endpoints. This permits repeated POST /users/forgotPasswordEmail and verificationEmail requests, mail bombing registered users, consuming Firebase or SMTP quota, evading brute-force protection, and enabling resource exhaustion. Exploitability of cf-connecting-ip depends on deployment topology, but x-forwarded-for and direct-to-origin paths remain affected when those values are not overwritten by a trusted proxy. No fixed version is available as of this review.
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted request to obtain limited unauthorized access to information. This results in a low impact on confidentiality. There is no impact on integrity and availability.
CVE-2026-72574 is a host header injection vulnerability in picocms/Pico versions prior to 2.1.5. It allows an unauthenticated remote attacker to manipulate the origin of JavaScript and CSS assets loaded by the default theme by exploiting how the base URL is constructed from unvalidated HTTP headers when base_url is unset.
CVE-2026-0516 is a medium severity vulnerability in SonicWall SonicOS involving improper neutralization of HTTP headers. This flaw allows a remote attacker to manipulate the Host header, potentially redirecting firewall management users to arbitrary web domains. No specific affected versions or patches have been disclosed yet.
Litestar versions prior to 2.22.0 contain a vulnerability in the AllowedHostsMiddleware where the X-Forwarded-Host header is trusted as a fallback when the Host header is missing. This allows an attacker to bypass allowed hosts validation by omitting the Host header and supplying a malicious X-Forwarded-Host header. The vulnerability enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. The issue is fixed in version 2.22.0.
HCL DevOps Loop is affected by missing HTTP security headers. Missing security headers may reduce browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.
Craft CMS is a content management system (CMS). Versions 4.0.0-RC1 and above, prior to 4.18.0 and 5.0.0-RC1, and above, prior to 5.10.0, are vulnerable to Server-Side Request Forgery (SSRF) and Arbitrary JavaScript Injection through the /actions/app/resource-js endpoint. By exploiting the default permissive trustedHosts configuration, an attacker can poison the Host or X-Forwarded-Host header to manipulate the application’s $baseUrl. This bypasses the endpoint’s internal URL validation, forcing the backend Guzzle client to fetch a malicious payload from an attacker-controlled server and reflect it to the client with a Content-Type: application/javascript header. The vulnerability manifests when assetManager.cacheSourcePaths is set to false. This issue has been fixed in versions 4.18.0 and 5.10.0.
IBM Engineering Workflow Management 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
IBM DevOps Plan versions 3.0.0 through 3.0.6 contain a vulnerability due to improper validation of HOST headers, leading to HTTP header injection. This flaw could enable attackers to perform cross-site scripting, cache poisoning, or session hijacking attacks. The vulnerability has a medium severity with a CVSS score of 6.5. No official patch or remediation guidance is currently provided by the vendor.
Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8.
A vulnerability in @fastify/reply-from (v12.6.1 and earlier) and @fastify/http-proxy (v11.4.3 and earlier) allows remote attackers to manipulate the Connection header to remove proxy-added headers. This can bypass security, routing, or access control mechanisms by stripping headers critical for these functions. The issue arises because the client’s Connection header is processed after the proxy adds its own headers, enabling retroactive removal. The vulnerability has a high attack complexity as it requires interception and manipulation of client-server communication. Upgrading to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later mitigates the issue.
IBM Aspera Shares versions 1.9.9 through 1.11.0 contain a vulnerability due to improper validation of HOST headers, leading to HTTP header injection. This flaw can enable attackers to perform attacks such as cross-site scripting, cache poisoning, or session hijacking. The vulnerability has a medium severity with a CVSS score of 5.4. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Versions up to and including 2.5.3 set ALLOWED_HOSTS = '*' by default, which causes Django to accept any value in the HTTP Host header without validation. The application uses request.build_absolute_uri() to generate absolute URLs in multiple contexts, including invite link emails, API pagination, and OpenAPI schema generation. An attacker who can send requests to the application with a crafted Host header can manipulate all server-generated absolute URLs. The most critical impact is invite link poisoning: when an admin creates an invite and the application sends the invite email, the link points to the attacker's server instead of the real application. When the victim clicks the link, the invite token is sent to the attacker, who can then use it at the real application. As of time of publication, it is unknown if a patched version is available.
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior.
This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout
of the WebClient and WebScheduler web apps.