{"id":"EUVD-2026-28509","enisaUuid":"f3548c38-e321-3e9f-a448-62f69eee93d9","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.","datePublished":"May 8, 2026, 3:42:50 AM","dateUpdated":"May 8, 2026, 10:40:56 AM","baseScore":7.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37\nhttps://github.com/dadrus/heimdall/pull/3208\nhttps://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943\nhttps://github.com/dadrus/heimdall/releases/tag/v0.17.14\n","aliases":"CVE-2026-42273\nGHSA-72h4-mxfc-jx37\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"6e32e1bf-7c39-33e4-95c8-fdb96da32c14","product":{"name":"Heimdall","vendor":{"name":"dadrus"}},"product_version":"\u003c 0.17.14"}],"enisaIdVendor":[{"id":"d750bc53-e472-3cc4-8c5e-f5b8aa2ca326","vendor":{"name":"dadrus"}}],"enisaIdVulnerability":[{"id":"696a8d03-66f1-31fa-8589-f424f6ce9cb8","vulnerability":{"id":"GHSA-72h4-mxfc-jx37","description":"Heimdall: Case-sensitive host matching may lead to policy bypass","datePublished":"Apr 25, 2026, 11:30:18 PM","dateUpdated":"May 12, 2026, 1:28:54 PM","baseScore":0.0,"references":"https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42273\nhttps://github.com/dadrus/heimdall/pull/3208\nhttps://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943\nhttps://github.com/dadrus/heimdall\nhttps://github.com/dadrus/heimdall/releases/tag/v0.17.14\n","enisa_id":"EUVD-2026-28509\n","aliases":"CVE-2026-42273\nGHSA-72h4-mxfc-jx37\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c4402754-23c8-3e9a-9849-cbdbb4543ad5","vulnerability":{"id":"CVE-2026-42273","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.","datePublished":"May 8, 2026, 3:42:50 AM","dateUpdated":"May 8, 2026, 10:40:56 AM","status":"PUBLISHED","baseScore":7.8,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37\nhttps://github.com/dadrus/heimdall/pull/3208\nhttps://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943\nhttps://github.com/dadrus/heimdall/releases/tag/v0.17.14\n","enisa_id":"EUVD-2026-28509\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Nov 1, 2026, 7:17:53 AM","vulnerabilityProduct":[{"id":"8fe01660-cf3b-39a8-91c3-9390f82b7b67","product":{"name":"Heimdall","vendor":{"name":"dadrus"}},"product_version":"\u003c 0.17.14"}],"vulnerabilityVendor":[{"id":"874f41f4-0907-31d8-86ed-26da9ac2f7e7","vendor":{"name":"dadrus"}}]}}],"enisaIdAdvisory":[]}