CVE-2026-100390 in Zoraxy
요약
\~에 의해 MITRE • 2026. 09. 25.
Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values to spoof their source IP and bypass authorization provider IP-based access controls.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.