CVE-2026-100724

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100724
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100724.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100724
Aliases
Published
2026-09-27T01:28:30Z
Modified
2026-09-27T11:45:23Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy
Details

http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header by default in reverseProxy() and reverseProxyRouting() when dispatching to configured virtual hosts. If these functions are deployed as a public-facing inbound HTTP handler with two or more configured virtual hosts, a remote attacker can supply a Host header that merely contains a configured vhost name (for example Host: admin.evil.com for a vhost configured as "admin") and be routed to that vhost, bypassing routing-based authorization. The intended outbound-dispatch and test-time uses, where the Host value is set by the calling application, are not affected.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-444"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100724.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "4.51.0.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/http4k/http4k

Affected ranges

Type
GIT
Repo
https://github.com/http4k/http4k
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
911eb36ed34ce8a8ec494f64044b9d49756ec45a
Fixed
e41f40814305510d4f82e30bb0bcd12b9928292e
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.49.0.0"
        },
        {
            "fixed":  "5.42.0.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*
0.0.0
3.*
3.260.0
3.261.0
3.262.0
3.263.0
3.264.0
3.265.0
3.266.0
3.268.0
3.269.0
3.271.0
3.274.0
3.275.0
3.276.0
3.277.0
3.278.0
3.279.0
3.283.0
3.283.1
3.284.0
3.285.0
3.285.1
3.285.2
4.*
4.0.0.0
4.1.0.0
4.1.1.0
4.1.1.1
4.1.1.2
4.1.2.0
4.1.2.1
4.10.0.0.0
4.10.0.1
4.10.1.0
4.11.0.0
4.11.0.1
4.12.0.0
4.12.0.1
4.12.1.0
4.12.2.0
4.12.3.0
4.12.3.1
4.13.0.0
4.13.1.0
4.13.3.0
4.13.4.0
4.14.0.0
4.14.1.0
4.14.1.1
4.14.1.2
4.14.1.3
4.14.1.4
4.15.0.0
4.16.0.0
4.16.0.1
4.16.1.0
4.16.2.0
4.16.3.0
4.17.0.0
4.17.1.0
4.17.2.0
4.17.3.0
4.17.4.0
4.17.5.0
4.17.6.0
4.17.7.0
4.17.8.0
4.17.9.0
4.18.0.0
4.19.0.0
4.19.1.0
4.19.2.0
4.19.3.0
4.19.4.0
4.19.5.0
4.2.0.0
4.20.0.0
4.20.1.0
4.20.2.0
4.21.0.0
4.21.1.0
4.21.1.1
4.22.0.0
4.22.0.1
4.23.0.0
4.24.0.0
4.25.0.0
4.25.1.0
4.25.10.0
4.25.10.1
4.25.11.0
4.25.12.0
4.25.13.0
4.25.14.0
4.25.15.0
4.25.16.0
4.25.16.1
4.25.16.2
4.25.2.0
4.25.3.0
4.25.4.0
4.25.4.1
4.25.5.0
4.25.5.1
4.25.5.2
4.25.6.0
4.25.7.0
4.25.8.0
4.25.9.0
4.26.0.0
4.27.0.0
4.27.1.0
4.27.2.0
4.27.3.0
4.27.4.0
4.28.0.0
4.28.1.0
4.28.2.0
4.29.0.0
4.29.1.0
4.3.0.0
4.3.2.0
4.3.2.1
4.3.2.2
4.3.3.0
4.3.4.0
4.3.4.1
4.3.5.0
4.3.5.1
4.3.5.2
4.3.5.3
4.3.5.4
4.30.0.0
4.30.10.0
4.30.2.0
4.30.2.1
4.30.3.0
4.30.4.0
4.30.5.0
4.30.6.0
4.30.7.0
4.30.8.0
4.30.9.0
4.31.0.0
4.32.0.0
4.32.1.0
4.32.2.0
4.32.3.0
4.32.4.0
4.33.0.0
4.33.1.0
4.33.2.0
4.33.2.1
4.33.3.0
4.34.0.0
4.34.0.1
4.34.0.2
4.34.0.3
4.34.0.4
4.34.1.0
4.34.2.0
4.34.3.0
4.34.3.1
4.34.4.0
4.35.0.0
4.35.1.0
4.35.2.0
4.35.3.0
4.35.4.0
4.36.0.0
4.37.0.0
4.38.0.0
4.38.0.1
4.39.0.0
4.4.0.0
4.4.0.1
4.4.1.0
4.4.2.0
4.40.0.0
4.40.1.0
4.40.2.0
4.41.0.0
4.41.1.0
4.41.1.1
4.41.2.0
4.41.3.0
4.41.4.0
4.42.0.0
4.42.1.0
4.43.0.0
4.43.1.0
4.44.0.0
4.44.1.0
4.45.0.0
4.46.0.0
4.47.1.0
4.47.2.0
4.48.0.0
4.5.0.0
4.5.0.1
4.6.0.0
4.7.0.0
4.7.0.1
4.7.0.2
4.7.1.0
4.8.0.0
4.8.1.0
4.8.2.0
4.9.0.0
4.9.0.1
4.9.0.2
4.9.1.0
4.9.10.0
4.9.2.0
4.9.3.0
4.9.3.1
4.9.4.0
4.9.5.0
4.9.6.0
4.9.7.0
4.9.8.0
4.9.9.0
5.*
5.0.0.0
5.1.0.0
5.1.1.0
5.1.1.1
5.1.2.0
5.1.2.1
5.10.0.0
5.10.1.0
5.10.2.0
5.10.3.0
5.10.4.0
5.10.5.0
5.10.6.0
5.10.7.0
5.11.0.0
5.11.1.0
5.12.0.0
5.12.1.0
5.12.2.0
5.12.2.1
5.13.0.0
5.13.0.1
5.13.1.0
5.13.2.0
5.13.4.0
5.13.4.1
5.13.5.0
5.13.6.0
5.13.6.1
5.13.7.0
5.13.8.0
5.13.9.0
5.14.0.0
5.14.1.0
5.14.2.0
5.14.4.0
5.14.5.0
5.15.0.0
5.16.0.0
5.16.1.0
5.16.2.0
5.17.0.0
5.18.1.0
5.18.2.0
5.19.0.0
5.2.0.0
5.2.1.0
5.20.0.0
5.21.0.0
5.21.1.0
5.21.2.0
5.22.0.0
5.23.0.0
5.24.0.0
5.24.1.0
5.25.0.0
5.25.1.0
5.26.0.0
5.26.1.0
5.27.0.0
5.28.0.0
5.28.1.0
5.29.0.0
5.3.0.0
5.30.0.0
5.30.1.0
5.31.0.0
5.31.1.0
5.32.0.0
5.32.1.0
5.32.2.0
5.32.3.0
5.32.4.0
5.33.0.0
5.33.0.1
5.33.1.0
5.34.0.0
5.34.1.0
5.35.0.0
5.35.1.0
5.35.2.0
5.35.3.0
5.35.4.0
5.35.5.0
5.36.0.0
5.37.0.0
5.37.1.0
5.37.1.1
5.38.0.0
5.39.0.0
5.4.0.0
5.4.1.0
5.40.0.0
5.41.0.0
5.42.0.0
5.43.0.0
5.44.0.0
5.44.1.0
5.44.2.0
5.44.3.0
5.45.0.0
5.45.1.0
5.45.2.0
5.46.0.0
5.47.0.0
5.5.0.0
5.6.0.0
5.6.1.0
5.6.2.0
5.6.2.1
5.6.3.0
5.6.4.0
5.6.5.0
5.7.1.0
5.7.2.0
5.7.3.0
5.7.4.0
5.7.5.0
5.8.0.0
5.8.1.0
5.8.2.0
5.8.3.0
5.8.4.0
5.8.5.0
5.8.5.1
5.8.6.0
5.9.0.0
6.*
6.0.0.0
6.0.1.0
6.1.0.0
6.1.0.1
6.10.0.0
6.10.1.0
6.10.2.0
6.11.0.0
6.11.1.0
6.12.0.0
6.13.0.0
6.14.0.0
6.15.0.0
6.15.0.1
6.15.1.0
6.16.0.0
6.17.0.0
6.18.0.1
6.18.1.0
6.19.0.0
6.2.0.0
6.20.0.0
6.20.0.1
6.20.0.2
6.20.0.3
6.20.1.0
6.20.2.0
6.20.2.1
6.21.0.0
6.21.1.0
6.22.0.0
6.23.0.0
6.23.1.0
6.24.0.0
6.24.1.0
6.25.0.0
6.25.1.0
6.26.0.0
6.26.1.0
6.27.0.0
6.28.0.0
6.28.1.0
6.29.0.0
6.30.0.0
6.30.1.0
6.31.0.0
6.31.1.0
6.32.0.0
6.33.0.0
6.34.0.0
6.35.0.0
6.36.0.0
6.37.0.0
6.38.0.0
6.39.0.0
6.39.1.0
6.4.0.0
6.4.1.0
6.40.0.0
6.40.1.0
6.41.0.0
6.42.0.0
6.43.0.0
6.44.0.0
6.45.0.0
6.45.1.0
6.46.0.0
6.46.1.0
6.47.0.0
6.47.1.0
6.47.2.0
6.48.0.0
6.5.0.0
6.5.1.0
6.5.2.0
6.5.3.0
6.5.4.0
6.5.5.0
6.5.5.1
6.5.6.0
6.5.6.1
6.6.0.0
6.6.0.1
6.6.1.0
6.7.0.0
6.8.0.0
6.8.1.0
6.9.0.0
6.9.1.0
6.9.2.0
v6.*
v6.3.0.0
v6.4.1.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100724.json"