Case Sensitivity Issue in Heimdall Identity Aware Proxy Affects Access Control

CVE-2026-42273

What is CVE-2026-42273?

Heimdall, a cloud native Identity Aware Proxy, previously handled host matching in a case-sensitive manner. This behavior conflicted with HTTP’s case-insensitive nature, which led to potential mismatches when requests were made with varying letter casing. Such discrepancies could inadvertently alter the classification of requests, ultimately affecting access control decisions. The issue has been addressed in version 0.17.14, ensuring that host matching functions correctly in accordance with standard HTTP rules.

References