CVE-2026-42273

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.

CVSS

No CVSS.

References

Link	Resource
https://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943
https://github.com/dadrus/heimdall/pull/3208
https://github.com/dadrus/heimdall/releases/tag/v0.17.14
https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37

Configurations

No configuration.

History

26 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Heimdall es un servicio de Proxy Consciente de Identidad y de Decisión de Control de Acceso nativo de la nube. Antes de la versión 0.17.14, Heimdall realiza la coincidencia de hosts de manera sensible a mayúsculas y minúsculas, mientras que los nombres de host HTTP no distinguen entre mayúsculas y minúsculas. Esta discrepancia puede hacer que Heimdall no logre hacer coincidir una regla para un host de solicitud que difiere solo en el uso de mayúsculas y minúsculas, lo que podría causar que la solicitud se clasifique de manera diferente a lo previsto. Este problema ha sido parcheado en la versión 0.17.14.

Information

Published : 2026-05-08 04:16

Updated : 2026-10-26 20:10

NVD link : CVE-2026-42273

Mitre link : CVE-2026-42273

CVE.ORG link : CVE-2026-42273

JSON object : View

Products Affected

No product.

CWE

CWE-178

Improper Handling of Case Sensitivity

CWE-436

Interpretation Conflict

{"id": "CVE-2026-42273", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42273", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-08T10:40:38.505776Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "dadrus", "product": "heimdall", "versions": [{"status": "affected", "version": "< 0.17.14"}]}]}], "published": "2026-05-08T04:16:22.457", "references": [{"url": "https://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943", "source": "security-advisories@github.com"}, {"url": "https://github.com/dadrus/heimdall/pull/3208", "source": "security-advisories@github.com"}, {"url": "https://github.com/dadrus/heimdall/releases/tag/v0.17.14", "source": "security-advisories@github.com"}, {"url": "https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-178"}, {"lang": "en", "value": "CWE-436"}]}], "descriptions": [{"lang": "en", "value": "Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14."}, {"lang": "es", "value": "Heimdall es un servicio de Proxy Consciente de Identidad y de Decisi\u00f3n de Control de Acceso nativo de la nube. Antes de la versi\u00f3n 0.17.14, Heimdall realiza la coincidencia de hosts de manera sensible a may\u00fasculas y min\u00fasculas, mientras que los nombres de host HTTP no distinguen entre may\u00fasculas y min\u00fasculas. Esta discrepancia puede hacer que Heimdall no logre hacer coincidir una regla para un host de solicitud que difiere solo en el uso de may\u00fasculas y min\u00fasculas, lo que podr\u00eda causar que la solicitud se clasifique de manera diferente a lo previsto. Este problema ha sido parcheado en la versi\u00f3n 0.17.14."}], "lastModified": "2026-10-26T20:10:00.160", "sourceIdentifier": "security-advisories@github.com"}