Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/dadrus/heimdall

6 known vulnerabilities (6 high), with the versions each affects and the releases that fix them.

Latest release
v0.17.28 (Oct 30, 2026): no advisory affects it
Newest unaffected release
v0.17.28 (Oct 30, 2026), the latest release
Advisories
6 · 6 high
Releases
75 since v0.15.0 (Sep 16, 2024)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-57210
    Affects v0.1.0-alpha to v0.17.16 (v0.17.17 is outside it)
  • CVE-2026-57209
    Affects v0.1.0-alpha to v0.17.16 (v0.17.17 is outside it)
  • CVE-2026-42274
    Affects v0.1.0-alpha to v0.17.13 (v0.17.14 is outside it)
  • CVE-2026-42273
    Affects v0.1.0-alpha to v0.17.13 (v0.17.14 is outside it)
  • CVE-2026-42272
    Affects v0.1.0-alpha to v0.17.13 (v0.17.14 is outside it)
  • CVE-2026-32811
    Affects v0.7.0-alpha to v0.17.10 (v0.17.11 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

  • Heimdall: IP Spoofing via Unvalidated Forwarding Headers

    Affected: fixed in 0.17.17.

    Fixed in v0.17.17 (released Jun 15, 2026, 130 days before disclosure).

    The latest release, v0.17.28, is not affected.

  • Heimdall: Forwarded Header Injection via Unsanitized Host Header in Proxy Mode

    Affected: fixed in 0.17.17.

    Fixed in v0.17.17 (released Jun 15, 2026, 130 days before disclosure).

    The latest release, v0.17.28, is not affected.

  • Heimdall: Authorization bypass via path normalization mismatch

    Affected: fixed in 0.17.14.

    Fixed in v0.17.14 (released Apr 19, 2026, 19 days before disclosure).

    The latest release, v0.17.28, is not affected.

  • Heimdall: Case-sensitive host matching may lead to policy bypass

    Affected: fixed in 0.17.14.

    Fixed in v0.17.14 (released Apr 19, 2026, 19 days before disclosure).

    The latest release, v0.17.28, is not affected.

  • Heimdall: Case-sensitive handling of URL-encoded slashes may lead to inconsistent path interpretation

    Affected: fixed in 0.17.14.

    Fixed in v0.17.14 (released Apr 19, 2026, 19 days before disclosure).

    The latest release, v0.17.28, is not affected.

  • Heimdall: Path received via Envoy gRPC corrupted when containing query string

    Affected: from 0.7.0-alpha, fixed in 0.17.11.

    Fixed in v0.17.11 (released Mar 15, 2026, 5 days before disclosure).

    The latest release, v0.17.28, is not affected.