CVE-2023-29406

Summary

CVE-2023-29406 refers to a vulnerability in the HTTP/1 client where the validation of the Host header is incomplete. Maliciously crafted Host headers can inject extra headers or even entire requests. This issue has been addressed by the updated HTTP/1 client, which now refuses to process requests containing an invalid Request.Host or Request.URL.Host value. This vulnerability can potentially lead to unintended request modifications or even man-in-the-middle attacks. It is essential to apply the necessary patches to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.