{"cve":"CVE-2026-57210","nvd":{"published":"2026-10-23T13:17:11.847","modified":"2026-10-23T19:57:42.660","status":"Deferred","description":"Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7.0},"cvss_v3":null,"cwes":["CWE-20","CWE-116","CWE-290"],"references":["https://github.com/dadrus/heimdall/releases/tag/v0.17.17","https://github.com/dadrus/heimdall/security/advisories/GHSA-38x9-25wx-7fg2"],"products":[],"source":"nvd","synced_at":"2026-10-24T16:53:35.584907681+00:00"},"epss":{"cve":"CVE-2026-57210","score":0.00307,"percentile":0.23252,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-38x9-25wx-7fg2","url":"https://osv.dev/vulnerability/GHSA-38x9-25wx-7fg2","summary":"Heimdall: IP Spoofing via Unvalidated Forwarding Headers","modified":"2026-08-11T20:51:05.251114822Z","packages":[{"ecosystem":"Go","name":"https://github.com/dadrus/heimdall","purl":"pkg:golang/https:/github.com/dadrus/heimdall","ranges":["<0.17.17"],"fixed":["0.17.17"]}]},{"id":"GO-2026-5075","url":"https://osv.dev/vulnerability/GO-2026-5075","summary":"Heimdall: IP Spoofing via Unvalidated Forwarding Headers in github.com/dadrus/heimdall","modified":"2026-08-11T20:33:01.848715448Z","packages":[{"ecosystem":"Go","name":"github.com/dadrus/heimdall","purl":"pkg:golang/github.com/dadrus/heimdall","ranges":["<0.17.17"],"fixed":["0.17.17"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}