Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Affected: github.com/fabiolb/fabio = 1.6.6 through 1.7.1 and master HEAD (c75f8a6). Summary The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders (proxy/httpheaders.go:28-36) containing only the 7 X-Forwarded family headers. Fabio also injects three operator-configured server-side trust headers that are NOT in that allowlist, so the original hop-by-hop stripping attack still works against them. Details The three unprotected trust headers and where fabio sets them: - ClientIPHeader (proxy.header.clientip) - httpheaders.go:73 r.Header.Set(cfg.ClientIPHeader, remoteIP) - TLSHeader (proxy.header.tls) - httpheaders.go:153 r.Header.Set(cfg.TLSHeader, cfg.TLSHeaderValue) (TLS connections) - RequestID (proxy.header.requestid) - httpproxy.go:90 r.Header.Set(p.Config.RequestID, id()) Order of operations in HTTPProxy.ServeHTTP: (1) line 90 sets RequestID; (2) line 175 calls addHeaders, which sweeps the Connection header (keeping the…
Recommended action: Upgrade to 1.7.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when routing requests to backend applications. Since the receiving application should trust these headers, allowing HTTP clients to remove or modify them creates potential security vulnerabilities. However, it was found that some of these custom headers can indeed be removed and, in certain cases, manipulated. The attack relies on the behavior that headers can be defined as hop-by-hop via the HTTP Connection header. By setting the following connection header, the X-Forwarded-Host header can, for example, be removed: Similar critical vulnerabilities have been identified in other web servers and proxies, including CVE-2022-31813 in Apache HTTP Server and CVE-2024-45410 in Traefik. Details It was found that the following headers can be removed in this way (i.e. by specifying…
Recommended action: Upgrade to 1.6.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.