https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 22:53:09 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309291 EUVD-2026-309291 https://cve.radiocsirt.org/vuln/euvd-2026-309291 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42272 <p>Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.</p> <p>Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall handles URL-encoded slashes (%2F) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (%2f) is not recognized and therefore not processed as expected when allow_encoded_slashes is set to off (the default setting). This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass. This issue has been patched in version 0.17.14.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-42272 https://cve.radiocsirt.org/vuln/ghsa-43jv-5j4x-qv67 <p><strong>Affected:</strong> Go: github.com/dadrus/heimdall</p> <p>### Summary</p> <p>Heimdall handles URL-encoded slashes (`%2F`) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (`%2f`) is not recognized and therefore not processed as expected when `allow_encoded_slashes` is set to `off` (the default setting).</p> <p>This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass.</p> <p>**Note:** The issue can only lead to unintended access if heimdall is configured with an &#34;allow all&#34; default rule. Since v0.16.0, heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled (e.g. via `--insecure-skip-secure-default-rule-enforcement` or the broader `--insecure` flag).</p> <p>### Details</p> <p>Consider the following rule configuration:</p> <p>```yaml id: rule-1 match: routes: - path: /admin/** execute: # configured to require authentication and authorization # ... ```</p> <p>If an adversary sends a request such as `/admin%2fsecret`, neither is the above rule matched, nor is the request rejected (as would be expected when `allow_encoded_slashes` is set to `off`). Instead, the default rule (if configured) will be executed.</p> <p>If the configured default rule is overly permissive (e.g. allowing anonymous access), and the upstream service interprets `%2f` as a path separator, the request may ultimately be processed as `/admin/secret`.</p> <p>This results i…</p> <p><strong>Affected:</strong> Go: github.com/dadrus/heimdall</p> <p>### Summary</p> <p>Heimdall handles URL-encoded slashes (`%2F`) in a case-sensitive manner, while percent-encoding is defined to be case-insensitive. As a result, the lowercase equivalent (`%2f`) is not recognized and therefore not processed as expected when `allow_encoded_slashes` is set to `off` (the default setting).</p> <p>This discrepancy can lead to differences in how request paths are interpreted by heimdall and upstream components, which may result in authorization bypass.</p> <p>**Note:** The issue can only lead to unintended access if heimdall is configured with an &#34;allow all&#34; default rule. Since v0.16.0, heimdall enforces secure defaults and refuses to start with such a configuration unless this enforcement is explicitly disabled (e.g. via `--insecure-skip-secure-default-rule-enforcement` or the broader `--insecure` flag).</p> <p>### Details</p> <p>Consider the following rule configuration:</p> <p>```yaml id: rule-1 match: routes: - path: /admin/** execute: # configured to require authentication and authorization # ... ```</p> <p>If an adversary sends a request such as `/admin%2fsecret`, neither is the above rule matched, nor is the request rejected (as would be expected when `allow_encoded_slashes` is set to `off`). Instead, the default rule (if configured) will be executed.</p> <p>If the configured default rule is overly permissive (e.g. allowing anonymous access), and the upstream service interprets `%2f` as a path separator, the request may ultimately be processed as `/admin/secret`.</p> <p>This results i…</p> https://cve.radiocsirt.org/vuln/ghsa-43jv-5j4x-qv67