Wso2 Carbon Event Publisher Core

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:wso2:wso2_carbon_event_publisher_core:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorWso2 (a7ddf9c6-bb76-50d9-a2c9-02e60ad69877)
ProductWso2 Carbon Event Publisher Core (f5e172a3-8b73-5074-814f-725b5d628c66)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
No PURL mappings for this CPE yet.

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-0637 vulnerable 2026-09-16 04:33:33.143219 Header Injection via Custom URL Configuration in Multiple WSO2 Products Allows Open Redirect and Log Forgery
MEDIUM (5.4)
When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs. An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
Published: 2026-08-06T07:33:20.334Z
Updated: 2026-11-04T13:47:20.802Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.