Weaknesses of type CWE-644

65 results

Neutralização inadequada de headers HTTP para sintaxe de script

A aplicação falha em sanitizar headers HTTP antes de usá-los em contextos onde código ou script pode ser interpretado, permitindo que um atacante injete comandos maliciosos. Isso ocorre quando dados do header (como User-Agent, Referer ou headers customizados) são refletidos em respostas sem validação, criando vetor para XSS ou injeção de código.

Example

Um servidor reflete o header 'X-Forwarded-For' diretamente em uma página de erro sem escapar caracteres especiais. Um atacante envia 'X-Forwarded-For: <script>alert(1)</script>' e o navegador executa o script, roubando sessão do usuário legítimo que visita a página.

How to mitigate

Valide e sanitize todos os headers HTTP antes de usá-los em respostas HTML ou contextos de execução. Use encodificação apropriada (HTML entity encoding para HTML, URL encoding para URLs) e implemente Content Security Policy (CSP) para limitar execução de scripts inline. Aplique whitelist rigorosa para headers esperados.

CVE-2026-33805CRITICAL@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headersEPSS 0.4%CVE-2021-38997MEDIUMIBM API Connect HOST header injectionEPSS 0.4%CVE-2025-64425HIGHCoolify has host header injection in forgot passwordEPSS 0.4%CVE-2026-72574MEDIUMpicocms Pico - Host Header Injection Enables Script Source HijackingEPSS 0.4%CVE-2025-0154MEDIUMIBM TXSeries for Multiplatforms information disclosureEPSS 0.4%CVE-2025-70948CRITICALA host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and exeEPSS 0.4%CVE-2025-13803MEDIUMMediaCrush Header paths.py http headers for scripting syntaxEPSS 0.4%CVE-2026-48061MEDIUMLitestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerEPSS 0.4%CVE-2022-22399MEDIUMIBM Aspera Faspex HTTP header injectionEPSS 0.4%CVE-2024-39736MEDIUMIBM Datacap Navigator HTTP HOST header injectionEPSS 0.4%CVE-2024-47549HIGHSharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP reEPSS 0.4%CVE-2026-66778MEDIUMMultiple vulnerabilities in SAP Business AI Platform (Approuter)EPSS 0.4%CVE-2026-0516MEDIUMA improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the HostEPSS 0.3%CVE-2026-110723HIGHIn `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from tEPSS 0.3%CVE-2026-48126HIGHAlgernon: Host header path traversal in --domain mode reads files and runs Lua from parent dirEPSS 0.3%CVE-2025-52660LOWHCL AION is affected by an Host Header Injection vulnerabilityEPSS 0.3%CVE-2026-54477MEDIUMGardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting SyntaxEPSS 0.3%CVE-2025-2950MEDIUMIBM i improper HTTP header neutralizationEPSS 0.3%CVE-2026-33149HIGHTandoor Recipes Vulnerable to Host Header InjectionEPSS 0.3%CVE-2024-30129MEDIUMHCL Nomad server on Domino is affected by a host header injection vulnerabilityEPSS 0.3%