http4k-core versions before 6.49.0.0, 5.42.0.0, and 4.51.0.0 use substring matching on the Host header in reverseProxy() and reverseProxyRouting() functions. This behavior can allow an attacker to bypass routing-based authorization by supplying a Host header that contains a configured virtual host name as a substring. This issue affects public-facing inbound HTTP handlers with multiple configured virtual hosts. The vulnerability does not affect outbound dispatch or test-time uses where the Host header is set by the application.