CVE-2026-42273

Heimdall: Case-sensitive host matching may lead to policy bypass

State: Published
Severity: 7.8 High
Published: May 8, 2026
Updated: May 8, 2026
Reserved: Apr 26, 2026

Description

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host that differs only in letter casing, potentially causing the request to be classified differently than intended. This issue has been patched in version 0.17.14.

Scores

CVSS	Score	Vector	Source
4.0	7.8 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N	GitHub_M

Weaknesses

CWE-436 Interpretation Conflict
CWE-178 Improper Handling of Case Sensitivity

Affected Products

Product	Versions
heimdalldadrus	< 0.17.14Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.