Home

Description

Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful exploit could result in the generation of manipulated links or responses, potentially leading to limited information disclosure or compromising the integrity of dependent services.

PUBLISHED Reserved 2026-06-04 | Published 2026-06-17 | Updated 2026-06-17 | Assigner INCIBE




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-644 Improper neutralization of HTTP headers for scripting syntax

Product status

Default status
unaffected

Any version before 08/07/2025
affected

08/07/2025 (date)
unaffected

References

www.incibe.es/...o/multiple-vulnerabilities-password-manager patch

cve.org (CVE-2026-10836)

nvd.nist.gov (CVE-2026-10836)

Download JSON