CVE-2026-42273 Details
Description
Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.
A vulnerability in Heimdall, a cloud-native Identity Aware Proxy and Access Control Decision service, allows for policy bypass due to case-sensitive host matching. This issue is present in Heimdall versions prior to 0.17.14. HTTP hostnames are inherently case-insensitive, and this mismatch can cause Heimdall to incorrectly classify requests based on the host header's letter casing. As a result, requests may be processed under unintended rules, potentially leading to unauthorized access or actions.
Users should update to Heimdall version 0.17.14 or later, where this vulnerability has been fixed. Additionally, avoid configuring permissive default rules that allow anonymous access. When using 'regex' type for host matching, define expressions to be case-insensitive. For example, use '(?i)^admin\.example\.com$' to match 'Admin.Example.Com'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dadrus/heimdall/commit/3d05e56a9e7ef0355f17482b4322054af4e85943 | [email protected] | Source CodeVendor |
| https://github.com/dadrus/heimdall/pull/3208 | [email protected] | Source CodeVendor |
| https://github.com/dadrus/heimdall/releases/tag/v0.17.14 | [email protected] | Release NotesVendor |
| https://github.com/dadrus/heimdall/security/advisories/GHSA-72h4-mxfc-jx37 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-178 | Improper Handling of Case Sensitivity | [email protected] |
| CWE-436 | Interpretation Conflict | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dadrus heimdall | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |