CVE-2026-100724

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/http4k/http4k/commit/0121b05537
https://github.com/http4k/http4k/commit/54c6385615
https://github.com/http4k/http4k/security/advisories/GHSA-jrpc-7vxp-69p6
https://www.vulncheck.com/advisories/http4k-before-6.49.0.0-host-header-routing-bypass-via-reverseproxy

Configurations

No configuration.

History

27 Sep 2026, 02:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-27 02:17

Updated : 2026-10-29 21:17

NVD link : CVE-2026-100724

Mitre link : CVE-2026-100724

CVE.ORG link : CVE-2026-100724

JSON object : View

Products Affected

No product.

CWE

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

{"id": "CVE-2026-100724", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-100724", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-30T15:15:13.800731Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "http4k", "product": "http4k", "versions": [{"status": "affected", "version": "6.0.0.0", "lessThan": "6.49.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "6.49.0.0", "versionType": "custom"}], "packageURL": "pkg:maven/org.http4k/http4k-core", "defaultStatus": "unaffected"}, {"vendor": "http4k", "product": "http4k", "versions": [{"status": "affected", "version": "5.0.0.0", "lessThan": "5.42.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "5.42.0.0", "versionType": "custom"}], "packageURL": "pkg:maven/org.http4k/http4k-core", "defaultStatus": "unaffected"}, {"vendor": "http4k", "product": "http4k", "versions": [{"status": "affected", "version": "0", "lessThan": "4.51.0.0", "versionType": "custom"}, {"status": "unaffected", "version": "4.51.0.0", "versionType": "custom"}], "packageURL": "pkg:maven/org.http4k/http4k-core", "defaultStatus": "unaffected"}]}], "published": "2026-09-27T02:17:20.603", "references": [{"url": "https://github.com/http4k/http4k/commit/0121b05537", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/http4k/http4k/commit/54c6385615", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/http4k/http4k/security/advisories/GHSA-jrpc-7vxp-69p6", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/http4k-before-6.49.0.0-host-header-routing-bypass-via-reverseproxy", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as \"admin\") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected."}], "lastModified": "2026-10-29T21:17:06.847", "sourceIdentifier": "disclosure@vulncheck.com"}