Executive brief
Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall
Affected products
- Go github.com/dadrus/heimdall
Junglewise Threat Intelligence
CVE-2026-57209: GO-2026-5125 - Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall
CVE-2026-57209 · Severity: medium · CVSS 4 · Published 2026-06-25
Technologies: github.com/dadrus/heimdall (Go). Vendors: Go.
Related threats
- GO-2026-5075 - Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall
- dadrus Heimdall Forwarded header injection in proxy mode
- dadrus Heimdall authorization bypass via path normalization mismatch
- Dadrus Heimdall case-sensitive host matching policy bypass
- dadrus Heimdall authorization bypass via case-sensitive URL encoding