Dashboard / CVE-2026-100724

CVE-2026-100724

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 73/100
Published: 2026-09-27 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: Present
VC: None
VI: None
VA: None

Description

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.

Weakness Classification (1)

Affected Software (6)

VendorProductVersion
http4k http4k 6.0.0.0 < 6.49.0.0
http4k http4k 5.0.0.0 < 5.42.0.0
http4k http4k 0 < 4.51.0.0
http4k http4k 6.0.0.0 < 6.49.0.0
http4k http4k 5.0.0.0 < 5.42.0.0
http4k http4k 0 < 4.51.0.0

References & Advisories (4)

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS — Exploitation Probability

0.34%
Raw Score 0.003440
Percentile 27.9%
Date 2026-10-29

Intelligence Sources

mitre ref →
nvd ref →

External Links