CVE-2026-57209

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-57209
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-57209.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-57209
Aliases
Downstream
Related
Published
2026-10-23T12:27:19Z
Modified
2026-11-04T17:27:05Z
Severity
  • 7.0 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode
Details

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when Heimdall operates in proxy mode, it constructs the Forwarded HTTP header after executing the matched rule pipeline by inserting the incoming request's Host header value directly into the header string without sanitizing commas or semicolons. This allows an attacker to inject additional parameters into the Forwarded header, potentially spoofing IP addresses for upstream services. This issue has been patched in version 0.17.17.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-74"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57209.json"
}
References

Affected packages

Git / github.com/dadrus/heimdall

Affected ranges

Type
GIT
Repo
https://github.com/dadrus/heimdall
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f1e837658d2ad6859679cd29fb3432015532945c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.17.17"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "original_tag": "v0.17.17",
            "range": [
                {
                    "fixed": "f1e837658d2ad6859679cd29fb3432015532945c"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.17.17"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v0.*
v0.1.0-alpha
v0.10.0-alpha
v0.10.1-alpha
v0.11.0-alpha
v0.11.1-alpha
v0.12.0-alpha
v0.13.0-alpha
v0.14.0-alpha
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.17.10
v0.17.11
v0.17.12
v0.17.13
v0.17.14
v0.17.15
v0.17.16
v0.17.2
v0.17.3
v0.17.4
v0.17.5
v0.17.6
v0.17.7
v0.17.8
v0.17.9
v0.2.0-alpha
v0.3.0-alpha
v0.4.0-alpha
v0.4.1-alpha
v0.5.0-alpha
v0.6.0-alpha
v0.6.1-alpha
v0.7.0-alpha
v0.8.0-alpha
v0.8.1-alpha
v0.8.2-alpha
v0.9.0-alpha
v0.9.1-alpha

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-57209.json"