# CVE-2026-100724: http4k reverse proxy host header substring matching bypass

Source: https://junglewise.ai/threats/cve-2026-100724-http4k-maven-package-org-http4k-http4k-core-before-6-49-0-0-5-42  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-27. Updated: 2026-09-27  
License: CC BY 4.0 with a link back

CVE-2026-100724 · Severity: medium · CVSS 5.4 · Published 2026-09-27

http4k is a Kotlin HTTP toolkit used to build web services and HTTP handlers. Versions before 6.49.0.0, 5.42.0.0, and 4.51.0.0 use substring matching on HTTP Host headers in reverse proxy routing, allowing attackers to bypass virtual host-based authorization by providing a Host header containing (rather than exactly matching) a configured virtual host name.

Technologies: [Http4k-Core](https://junglewise.ai/threats/technologies/http4k-core). Vendors: [Http4k](https://junglewise.ai/threats/vendors/http4k).

## Quick answers

**Is CVE-2026-100724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100724 being exploited in the wild.

**How severe is CVE-2026-100724?** Medium severity, with a CVSS score of 5.4, published 27 September 2026.

**Which products and versions are affected?** Http4k-Core before 6.49.0.0, 5.42.0.0, and 4.51.0.0.

**Is there a fix for CVE-2026-100724?** A patch was published on 2026-05-28: Commit 54c6385 changed default to Exact matching Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100724 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-100724?** Check whether you run Http4k-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The reverseProxy() and reverseProxyRouting() functions use substring (Contains) matching by default to dispatch requests to virtual hosts based on the Host header, rather than exact matching. A remote attacker can provide a Host header like "admin.evil.com" to match a vhost configured as "admin", bypassing routing-based authorization controls. The vulnerability affects only public-facing inbound HTTP handlers with two or more configured virtual hosts; outbound and test-time uses are unaffected since the Host header is application-controlled.

## Affected products

- http4k http4k-core before 6.49.0.0, 5.42.0.0, and 4.51.0.0

## Timeline

- 2026-09-27: disclosed
- 2026-05-28: patched: Commit 54c6385 changed default to Exact matching

## References

- [https://github.com/http4k/http4k/commit/0121b05537](https://github.com/http4k/http4k/commit/0121b05537)
- [https://github.com/http4k/http4k/commit/54c6385615](https://github.com/http4k/http4k/commit/54c6385615)

## Related threats

- [http4k cookie storage domain scoping bypass](https://junglewise.ai/threats/cve-2026-100725-http4k-maven-artifact-org-http4k-http4k-core-before-6-48-0-0-5)
- [http4k unbounded gzip decompression denial of service](https://junglewise.ai/threats/cve-2026-53659-http4k-unbounded-gzip-decompression-denial-of-service)
- [http4k information exposure via improper cookie scoping in BasicCookieStorage](https://junglewise.ai/threats/http4k-information-exposure-via-improper-cookie-scoping-in-24a5c491)
- [http4k misleading HmacSha256.hash naming leads to unkeyed digest usage](https://junglewise.ai/threats/http4k-misleading-hmacsha256-hash-naming-leads-to-unkeyed-digest-usage-d5026b8c)
- [http4k auth bypass via loose Host matching in reverseProxy](https://junglewise.ai/threats/http4k-auth-bypass-via-loose-host-matching-in-reverseproxy-bcd046a3)