Quick answers
- Is CVE-2026-100724 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-100724 being exploited in the wild.
- How severe is CVE-2026-100724?
- Medium severity, with a CVSS score of 5.4, published 27 September 2026.
- Which products and versions are affected?
- Http4k-Core before 6.49.0.0, 5.42.0.0, and 4.51.0.0.
- Is there a fix for CVE-2026-100724?
- A patch was published on 2026-05-28: Commit 54c6385 changed default to Exact matching Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-100724 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-100724?
- Check whether you run Http4k-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The reverseProxy() and reverseProxyRouting() functions use substring (Contains) matching by default to dispatch requests to virtual hosts based on the Host header, rather than exact matching. A remote attacker can provide a Host header like "admin.evil.com" to match a vhost configured as "admin", bypassing routing-based authorization controls. The vulnerability affects only public-facing inbound HTTP handlers with two or more configured virtual hosts; outbound and test-time uses are unaffected since the Host header is application-controlled.
Affected products
- http4k http4k-core before 6.49.0.0, 5.42.0.0, and 4.51.0.0
Timeline
- 2026-09-27: disclosed
- 2026-05-28: patched: Commit 54c6385 changed default to Exact matching