CVE-2026-42273: Heimdall: Case-sensitive host matching may lead to policy bypass
(updated )
Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended.
Note: The issue can only lead to unintended access if heimdall is configured with an “allow all” default rule. Since v0.16.0, heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled, e.g. via --insecure-skip-secure-default-rule-enforcement or the broader --insecure flag.
References
- github.com/advisories/GHSA-72h4-mxfc-jx37
- github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943
- github.com/dadrus/heimdall/pull/3208
- github.com/dadrus/heimdall/releases/tag/v0.17.14
- github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37
- nvd.nist.gov/vuln/detail/CVE-2026-42273
Code Behaviors & Features
Detect and mitigate CVE-2026-42273 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →