HIGHGo
GHSA-3q34-rx83-r6mq· CVE-2026-42274, GO-2026-5097Heimdall has an authorization bypass via path normalization mismatch
Modified: 6/25/2026
package
Go/github.com/dadrus/heimdall
pkg:go/github.com/dadrus/heimdall
HIGHGo
GHSA-43jv-5j4x-qv67· CVE-2026-42272, GO-2026-5108Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Modified: 6/25/2026
HIGHGo
GHSA-4jgr-pg2m-m988· CVE-2026-57209, GO-2026-5125Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode
Modified: 7/20/2026
HIGHGo
GHSA-72h4-mxfc-jx37· CVE-2026-42273, GO-2026-5200Heimdall: Case-sensitive host matching may lead to policy bypass
Modified: 6/25/2026
HIGH8.2Go
GHSA-r8x2-fhmf-6mxp· CVE-2026-32811, GO-2026-4742Heimdall: Path received via Envoy gRPC corrupted when containing query string
Modified: 4/27/2026
—Go
GO-2026-4742· CVE-2026-32811, GHSA-r8x2-fhmf-6mxpHeimdall: Path received via Envoy gRPC corrupted when containing query string in github.com/dadrus/heimdall
Modified: 3/23/2026
—Go
GO-2026-5075· CVE-2026-57210, GHSA-38x9-25wx-7fg2Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall
Modified: 8/11/2026
—Go
GO-2026-5097· CVE-2026-42274, GHSA-3q34-rx83-r6mqHeimdall has an authorization bypass via path normalization mismatch in github.com/dadrus/heimdall
Modified: 6/25/2026
—Go
GO-2026-5108· CVE-2026-42272, GHSA-43jv-5j4x-qv67Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation in github.com/dadrus/heimdall
Modified: 6/25/2026
—Go
GO-2026-5125· CVE-2026-57209, GHSA-4jgr-pg2m-m988Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode in github.com/dadrus/heimdall
Modified: 7/20/2026
—Go
GO-2026-5200· CVE-2026-42273, GHSA-72h4-mxfc-jx37Heimdall: Case-sensitive host matching may lead to policy bypass in github.com/dadrus/heimdall
Modified: 6/25/2026