{"schema":"threatline.record/2","record":{"id":"GHSA-jrpc-7vxp-69p6","aliases":["CVE-2026-100724","GHSA-jrpc-7vxp-69p6"],"summary":"http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`","details":"### Impact\n\n`reverseProxy()` and `reverseProxyRouting()` matched configured vhosts by substring on the `Host` header (`Contains` matcher) by default. The intended use of these functions in http4k is **outbound dispatch** (e.g. matching AWS service subdomains, per the `Contains` docstring) and **test-time composition** of fake backend networks. In either of those contexts the matched `Host` is set by the calling application, not by an external attacker, so the loose match has no exploit surface.\n\nIf, however, `reverseProxy()` was deployed as a public-facing inbound HTTP handler — which the function technically supports but is not the documented intent — an external attacker could send `Host: admin.evil.com` and reach a vhost configured as `admin`, bypassing routing-based authorization.\n\nThe `Contains` matcher's docstring explicitly documented this loose behaviour, but because `Contains` was the default, callers who never read the matcher docs would still get the loose behaviour.\n\n**Who is affected:** only deployments using `reverseProxy()` / `reverseProxyRouting()` as a public-facing inbound HTTP handler with two or more configured virtual hosts. The intended outbound / test-time usage is unaffected. If you *did* deploy `reverseProxy()` inbound and rely on multi-vhost routing for authorization, treat upgrade as urgent.\n\n### Patches\n\n| Line | Fixed in | Edition |\n|------|----------|---------|\n| v6.x (Community) | **6.49.0.0** | Community |\n| v5.x (LTS) | **5.42.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if `reverseProxy()` is present in your v5.x line) |\n| v4.x (LTS) | **4.51.0.0** | Enterprise — contact [enterprise@http4k.org](mailto:enterprise@http4k.org) (if `reverseProxy()` is present in your v4.x line) |\n\nThe fix changes the default matcher to `Exact`. Existing callers that genuinely need substring matching (e.g. AWS subdomain dispatch) must explicitly pass `matcher = Contains`.\n\n### Workarounds\n\nFor deployments that cannot upgrade immediately: wrap your `reverseProxy()` with a host-allow-list filter that requires an exact match against expected vhost names before delegating.","categories":["Libraries & packages"],"product":"org.http4k:http4k-core","vendor":"","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-24T14:57:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-core"},"range":">= 5.0.0.0, < 5.42.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-24T14:57:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-core"},"range":"< 4.51.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-24T14:57:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-core"},"range":">= 6.0.0.0, < 6.49.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-27T11:56:07.608749487Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-core","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0.0"},{"fixed":"6.49.0.0"}]}],"versions":["6.0.0.0","6.0.1.0","6.1.0.0","6.1.0.1","6.10.0.0","6.10.1.0","6.10.2.0","6.11.0.0","6.11.1.0","6.12.0.0","6.13.0.0","6.14.0.0","6.15.0.0","6.15.0.1","6.15.1.0","6.16.0.0","6.17.0.0","6.18.0.1","6.18.1.0","6.19.0.0","6.2.0.0","6.20.0.0","6.20.0.1","6.20.0.2","6.20.0.3","6.20.1.0","6.20.2.0","6.20.2.1","6.21.0.0","6.21.1.0","6.22.0.0","6.23.0.0","6.23.1.0","6.24.0.0","6.24.1.0","6.25.0.0","6.25.1.0","6.26.0.0","6.26.1.0","6.27.0.0","6.28.0.0","6.28.1.0","6.29.0.0","6.30.0.0","6.30.1.0","6.31.0.0","6.31.1.0","6.32.0.0","6.33.0.0","6.34.0.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-27T11:56:07.608749487Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-core","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0.0"},{"fixed":"5.42.0.0"}]}],"versions":["5.0.0.0","5.1.0.0","5.1.1.0","5.1.1.1","5.1.2.0","5.1.2.1","5.10.0.0","5.10.1.0","5.10.2.0","5.10.3.0","5.10.4.0","5.10.5.0","5.10.6.0","5.10.7.0","5.11.0.0","5.11.1.0","5.12.0.0","5.12.1.0","5.12.2.0","5.12.2.1","5.13.0.0","5.13.0.1","5.13.1.0","5.13.2.0","5.13.4.0","5.13.4.1","5.13.5.0","5.13.6.0","5.13.6.1","5.13.7.0","5.13.8.0","5.13.9.0","5.14.0.0","5.14.1.0","5.14.2.0","5.14.4.0","5.14.5.0","5.15.0.0","5.16.0.0","5.16.1.0","5.16.2.0","5.17.0.0","5.18.1.0","5.18.2.0","5.19.0.0","5.2.0.0","5.2.1.0","5.20.0.0","5.21.0.0","5.21.1.0"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-27T11:56:07.608749487Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-core","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.51.0.0"}]}],"versions":["0.21.0","0.22.0","1.0.0","1.1.0","1.10.0","1.11.0","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.19.1","1.2.0","1.20.0","1.21.0","1.21.1","1.22.0","1.22.2","1.23.0","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.26.2","1.27.0","1.28.0","1.3.0","1.30.0","1.31.0","1.32.0","1.32.1","1.32.2","1.33.0","1.33.1","1.4.0","1.5.0","1.6.0","1.7.0","1.8.0","1.9.0","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.1.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-24T14:57:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-core"},"version":"5.42.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-24T14:57:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-core"},"version":"4.51.0.0"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-24T14:57:45Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.http4k:http4k-core"},"version":"6.49.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-27T11:56:07.608749487Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-core","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-core"},"version":"6.49.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-27T11:56:07.608749487Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-core","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-core"},"version":"5.42.0.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","source_modified_at":"2026-09-27T11:56:07.608749487Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"org.http4k:http4k-core","ecosystem":"Maven","purl":"pkg:maven/org.http4k/http4k-core"},"version":"4.51.0.0"}],"cvss":6.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-06-19T21:15:59Z","modified_at":"2026-09-27T11:56:07.608749487Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T14:57:45Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-jrpc-7vxp-69p6","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-27T11:56:07.608749487Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/http4k/http4k/security/advisories/GHSA-jrpc-7vxp-69p6","source":"GitHub Advisory Database"},{"url":"https://github.com/http4k/http4k/commit/0121b05537","source":"GitHub Advisory Database"},{"url":"https://github.com/http4k/http4k/commit/54c6385615","source":"GitHub Advisory Database"},{"url":"https://github.com/http4k/http4k/releases/tag/6.49.0.0","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-jrpc-7vxp-69p6","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-27T11:56:07.608749487Z","content_hash":"35f793066406b7f7ef16bc8f7e7780b3811c2a3a45a4b0bcba6ddcfe7e191e6d"}}