LinuxServer docker-heimdall 2.6.3-ls307
Approved changes feed: RSS · Atom
cpe:2.3:a:linuxserver:docker-heimdall:2.6.3-ls307:*:*:*:*:*:*:*
part: a version: 2.6.3-ls307 update: *
| Vendor | Linuxserver (617dd4b5-1afe-5353-b0a8-d45b095479dc) |
|---|---|
| Product | Docker Heimdall (40f90d99-844a-5912-99f5-345999b82645) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/linuxserver/docker-heimdall |
purl2cpe | 2026-06-01 10:16:33.997717 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-50578 |
vulnerable | 2026-06-08 07:31:10.977790 |
Details available
LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application.
Published: 2025-07-30T00:00:00.000Z
Updated: 2025-07-30T15:43:42.692Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.