dadrus Heimdall up to 0.17.16 Forwarded header parser for input validation

Summaryinfo

A vulnerability has been found in dadrus Heimdall up to 0.17.16 and classified as critical. This affects an unknown function of the component Forwarded header parser. This manipulation of the argument for causes input validation. This vulnerability is registered as CVE-2026-57210. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in dadrus Heimdall up to 0.17.16 and classified as critical. Affected by this vulnerability is an unknown part of the component Forwarded header parser. The manipulation of the argument for with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.17, when the trusted_proxies option is configured, heimdall extracts client IP addresses from the Forwarded (for= parameter) and X-Forwarded-For headers and exposes them as Request.ClientIPAddresses to the rule pipeline. However, extracted values are not validated to be syntactically valid IP addresses. Arbitrary strings, malformed IP literals, and RFC 7239 unknown values and obfuscated identifiers are accepted without further checks. In addition, the Forwarded header parser splits on , and ; without accounting for RFC 7239 quoted strings, which can cause a single quoted value to be parsed as multiple entries, with fragments — including trailing quote characters — treated as independent addresses. This issue has been patched in version 0.17.17.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-57210 since 06/24/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available.

Upgrading to version 0.17.17 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• dadrus

Name

• Heimdall

Version

• 0.17.0
• 0.17.1
• 0.17.2
• 0.17.3
• 0.17.4
• 0.17.5
• 0.17.6
• 0.17.7
• 0.17.8
• 0.17.9
• 0.17.10
• 0.17.11
• 0.17.12
• 0.17.13
• 0.17.14
• 0.17.15
• 0.17.16

Website

• Product: https://github.com/dadrus/heimdall/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion