CVE-2026-100724
Description
A flaw was found in http4k. When reverse proxy routing is configured with multiple virtual hosts, incoming HTTP Host headers are evaluated using loose substring matching instead of exact matching. A remote attacker can exploit this vulnerability by submitting a crafted Host header that contains the name of an internal or privileged host, allowing them to bypass routing-based authorization controls and access restricted endpoints.
Statement
A moderate severity routing authorization bypass was found in http4k (Maven component org.http4k:http4k-core). By default, the reverseProxy() and reverseProxyRouting() functions match configured virtual hosts using loose substring (Contains) matching on the HTTP Host header. When such a handler is deployed as a public-facing inbound HTTP endpoint with two or more configured virtual hosts, a remote, unauthenticated attacker can send a request with a crafted Host header that merely contains a configured virtual host name (for example, Host: admin.evil.com for a vhost configured as "admin") and have the request routed to that virtual host, bypassing routing-based authorization and accessing restricted endpoints. The intended outbound-dispatch and test-time uses of these functions, where the Host value is set by the calling application, are not affected. Within the Red Hat portfolio, the http4k-core component shipped in Red Hat JBoss Fuse 7 (fuse-7-els-2 stream) is marked affected; however, that stream is not in full support scope and the affect is resolved as out of support scope. Red Hat rates this flaw MODERATE with CVSS 4.8, slightly lower than the upstream CVSS 5.4, because the routing bypass operates within the application's authorization environment and does not cross a security boundary (scope unchanged rather than changed).
Mitigation
For deployments that cannot upgrade immediately, wrap the reverseProxy() handler with a host-allow-list filter that requires an exact match against the expected virtual host names before delegating requests, as documented in the upstream advisory. Deployments that use reverseProxy() or reverseProxyRouting() only for the intended outbound-dispatch or test-time purposes, where the Host value is set by the calling application, are not exposed to this flaw. Upgrading to a fixed upstream http4k release (6.49.0.0 for the v6.x community line, or 5.42.0.0 / 4.51.0.0 for the v5.x and v4.x LTS enterprise lines) resolves the issue by changing the default Host matcher to exact matching.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.8 | N/A | 5.4 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
This can lead to incorrect results and resultant weaknesses. For example, the code might inadvertently compare references to objects, instead of the relevant contents of those objects, causing two "equal" objects to be considered unequal.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
