Keter, an app-server/reverse-proxy used with Yesod web-framework webapps, has a reflected cross-site scripting (XSS) vulnerability. The vulnerability arises because Keter echoes back the Host header value unescaped in an HTML error page during VHost dispatch handling. While direct exploitation from a browser is generally limited due to Host header restrictions, the flaw could be exploitable if combined with other upstream weaknesses in the HTTP proxy chain. A fix is available in version 1.8.4.