dadrus vulnerabilities

Newest CVEs

• CVE-2026-57210

  Heimdall: IP Spoofing via Unvalidated Forwarding Headers

  dadrus · heimdall

  High7.0
• CVE-2026-57209

  Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

  dadrus · heimdall

  High7.0
• CVE-2026-42274

  Heimdall: Authorization bypass via path normalization mismatch

  dadrus · heimdall

  High7.8
• CVE-2026-42273

  Heimdall: Case-sensitive host matching may lead to policy bypass

  dadrus · heimdall

  High7.8
• CVE-2026-42272

  Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

  dadrus · heimdall

  High7.8
• CVE-2026-32811

  Heimdall: Path received via Envoy gRPC corrupted when containing query string

  dadrus · heimdall

  High8.2