CVE-2026-42272

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42272
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42272.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42272
Aliases
Downstream
Related
Published
2026-05-08T03:40:17Z
Modified
2026-08-12T03:51:20Z
Severity
  • 7.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation
Details

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-178",
        "CWE-436"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42272.json"
}
References

Affected packages

Git / github.com/dadrus/heimdall

Affected ranges

Type
GIT
Repo
https://github.com/dadrus/heimdall
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8b0de6aba23a047cfee3081df878271bb17f4351
Fixed
c89e65c0d7cc0c2456c067836614ab9190771088
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.17.14"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0-alpha
v0.10.0-alpha
v0.10.1-alpha
v0.11.0-alpha
v0.11.1-alpha
v0.12.0-alpha
v0.13.0-alpha
v0.14.0-alpha
v0.15.0
v0.16.0
v0.17.0
v0.17.1
v0.17.10
v0.17.11
v0.17.12
v0.17.13
v0.17.2
v0.17.3
v0.17.4
v0.17.5
v0.17.6
v0.17.7
v0.17.8
v0.17.9
v0.2.0-alpha
v0.3.0-alpha
v0.4.0-alpha
v0.4.1-alpha
v0.5.0-alpha
v0.6.0-alpha
v0.6.1-alpha
v0.7.0-alpha
v0.8.0-alpha
v0.8.1-alpha
v0.8.2-alpha
v0.9.0-alpha
v0.9.1-alpha

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42272.json"