Most recent entries from all

EUVD-2026-5277

fkie_cve-2024-32980

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.

GHSA-f3h7-gpjj-wcvh — Spin applications with specific configuration vulnerable to potential network sandbox escape

Affected: crates.io: spin-sdk

### Impact Some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header.

If an application's manifest contains a component with configuration such as ```toml allowed_outbound_hosts = ["http://self", "https://self"] ```

and code such as ```rust let res: Response = spin_sdk::http::send( Request::new(Method::Get, "/") // Note: the request URI does not contain a URL authority ).await?; ```

Then that application can be induced to send an outgoing request to another host (leading the app to process the response assuming it comes from another component in the same application). This can be induced with a request such as ```shell curl -H"Host: google.com:80" localhost:3000 # Assuming the application is served on localhost:3000 ```

> Note: If using a SDK that does not use `wasi:http/outgoing-handler`, the port can be omitted from the URL.

#### Vulnerable Configurations

The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to the original value by the client. 2. The Spin application's component handling the incoming request is configured with an `allowed_outbound_hosts` list containing `"self"`. 3. In reaction to an incoming request, the component makes an outbound…

Most recent entries from all

EUVD-2026-5277

fkie_cve-2024-32980

GHSA-f3h7-gpjj-wcvh — Spin applications with specific configuration vulnerable to potential network sandbox escape

gsd-2024-32980