Executive brief
A vulnerability in the http4k toolkit's reverse proxy component could allow unauthorized access to internal services. By default, the system used loose matching for web addresses, meaning an attacker could bypass security rules by using a specially crafted address that merely contains a legitimate name. This could lead to unauthorized access to administrative interfaces or sensitive internal data if the proxy is used to handle public internet traffic.
Technical details
The `reverseProxy()` and `reverseProxyRouting()` functions in `http4k-core` defaulted to a `Contains` matcher for the HTTP `Host` header. When deployed as a public-facing inbound handler with multiple virtual hosts, an attacker can provide a `Host` header like `admin.attacker.com` to match a vhost configured as `admin`. This results in an inconsistent interpretation of HTTP requests (CWE-444), allowing for authorization bypass. The vulnerability is exploitable over the network without authentication if the application relies on these functions for inbound routing security. The fix changes the default matcher to `Exact`.
Affected products
- http4k http4k-core < 4.51.0.0, >= 5.0.0.0 < 5.42.0.0, >= 6.0.0.0 < 6.49.0.0
Timeline
- 2026-06-16: disclosed
- 2026-06-19: advisory
- 2026-06-19: patched: Patched in versions 6.49.0.0, 5.42.0.0, and 4.51.0.0
References
- https://github.com/http4k/http4k/security/advisories/GHSA-jrpc-7vxp-69p6
- https://github.com/http4k/http4k/commit/0121b05537
- https://github.com/http4k/http4k/commit/54c6385615
- https://github.com/http4k/http4k/releases/tag/6.49.0.0
- https://api.github.com/repos/http4k/http4k/security-advisories/GHSA-jrpc-7vxp-69p6