Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-42272 · Microsoft / collected KEV context

EUVD-2026-28508

GHSA-43jv-5j4x-qv67

GO-2026-5108

cve-program · CVE-2026-42272

• https://github.com/dadrus/heimdall/security/advisories/GHSA-43jv-5j4x-qv67
• https://github.com/dadrus/heimdall/pull/3207
• https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351
• https://github.com/dadrus/heimdall/releases/tag/v0.17.14

euvd · EUVD-2026-28508

• https://github.com/dadrus/heimdall/security/advisories/GHSA-43jv-5j4x-qv67
• https://github.com/dadrus/heimdall/pull/3207
• https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351
• https://github.com/dadrus/heimdall/releases/tag/v0.17.14

nvd · CVE-2026-42272

• https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351
• https://github.com/dadrus/heimdall/pull/3207
• https://github.com/dadrus/heimdall/releases/tag/v0.17.14
• https://github.com/dadrus/heimdall/security/advisories/GHSA-43jv-5j4x-qv67

osv · GHSA-43jv-5j4x-qv67

• https://github.com/dadrus/heimdall/security/advisories/GHSA-43jv-5j4x-qv67
• https://nvd.nist.gov/vuln/detail/CVE-2026-42272
• https://github.com/dadrus/heimdall/pull/3207
• https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351
• https://github.com/dadrus/heimdall
• https://github.com/dadrus/heimdall/releases/tag/v0.17.14

osv · GO-2026-5108

• https://github.com/dadrus/heimdall/security/advisories/GHSA-43jv-5j4x-qv67
• https://nvd.nist.gov/vuln/detail/CVE-2026-42272
• https://github.com/dadrus/heimdall/commit/8b0de6aba23a047cfee3081df878271bb17f4351
• https://github.com/dadrus/heimdall/pull/3207
• https://github.com/dadrus/heimdall/releases/tag/v0.17.14

No related operational record is retained in the current change model.