Heimdall: Case-sensitive host matching may lead to policy bypass
Priority MEDIUM 40CWE-178Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed heimdall (dadrus): 0.17.14github.com/dadrus/heimdall (Go): 0.17.14
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dadrus | heimdall | before 0.17.14 | 0.17.14 | Patch available | CNA |
| — | github.com/dadrus/heimdall (Go) | before 0.17.14 | 0.17.14 | Patch available | GHSA-72h4-mxfc-jx37 |
- heimdall Vendordadrus Affected before 0.17.14 Fixed in 0.17.14 Patch available CNA
- github.com/dadrus/heimdall (Go) Vendor— Affected before 0.17.14 Fixed in 0.17.14 Patch available GHSA-72h4-mxfc-jx37
Remediation
- Fix · CNA heimdall (dadrus) Fixed in 0.17.14
- Fix · GHSA-72h4-mxfc-jx37 github.com/dadrus/heimdall (Go) Fixed in 0.17.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-42273
- 2026-10-03 Alias added: GHSA-72h4-mxfc-jx37
References
More dadrus vulnerabilities
- TI-2026-25280 Heimdall: Path received via Envoy gRPC corrupted when containing query string CVSS 3.1HIGH 8.2
- TI-2026-79758 Forwarded header injection in Heimdall proxy mode via Host header CVSS 4.0HIGH 7.0
- TI-2026-30583 Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation CVSS 4.0HIGH 7.8
- TI-2026-30585 Heimdall: Authorization bypass via path normalization mismatch CVSS 4.0HIGH 7.8
- TI-2026-79759 IP spoofing in Heimdall via unvalidated forwarding headers CVSS 4.0HIGH 7.0
Sources
- CVE-2026-42273 · CVE Program
- CVE-2026-42273 · NVD
- FIRST EPSS
- GHSA-72h4-mxfc-jx37 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences