CVE-2026-31908

Apache APISIX: forward auth plugin allows header injection

Résumé

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Header injection vulnerability in Apache APISIX.

The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers.
This issue affects Apache APISIX: from 2.12.0 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Paquets affectés

Bitnami apisix

[{"type":"SEMVER","events":[{"introduced":"2.12.0"},{"fixed":"3.16.0"}]}]

Références

advisory openwall.com
advisory lists.apache.org
web nvd.nist.gov