GO-2026-6566 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header in github.com/fabiolb/fabio

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers clientip/tls/requestid still strippable via the Connection header in github.com/fabiolb/fabio...

Linux Distros Unpatched Vulnerability : CVE-2026-62987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses...

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Affected: github.com/fabiolb/fabio = 1.6.6 through 1.7.1 and master HEAD c75f8a6. Summary The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders proxy/httpheaders.go:28-36 containing only the 7 X-Forwarded family headers. Fabio also...

GHSA-FQ95-V8XC-JM3V Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Affected: github.com/fabiolb/fabio = 1.6.6 through 1.7.1 and master HEAD c75f8a6. Summary The v1.6.6 fix for CVE-2025-48865 sweeps the client Connection header against a hardcoded allowlist protectHeaders proxy/httpheaders.go:28-36 containing only the 7 X-Forwarded family headers. Fabio also...

EUVD-2026-83986

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers clientip/tls/requestid still strippable via the Connection header...

CVE-2026-62987

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

UBUNTU-CVE-2026-62987

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987

Fabio (an HTTP/S and TCP router for Consul-managed applications) versions 1.6.6 through 1.7.2 contain an incomplete fix for CVE-2025-48865 . The protectHeaders logic in proxy/http_headers.go covers a hardcoded set of forwarded headers but omits operator-configured ClientIPHeader , TLSHeader , and...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

PT-2026-96149

Name of the Vulnerable Software and Affected Versions Fabio versions 1.6.6 through 1.7.1 Description An issue exists in the way the router handles HTTP headers. In the proxy/http headers.go file, the protectHeaders function uses a hardcoded set of forwarded headers but fails to include...

CVE-2026-62987: Authentication Bypass by Spoofing

Fabio is an HTTPS and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/httpheaders.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In...

CVE-2025-23671

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sav WP OpenSearch wp-opensearch allows Stored XSS.This issue affects WP OpenSearch: from n/a through = 1.0...

EUVD-2025-3330

Malicious code in bioql PyPI...

EUVD-2023-53187

Malicious code in bioql PyPI...

EUVD-2025-16398

Malicious code in bioql PyPI...

EUVD-2024-31279

Malicious code in bioql PyPI...

awesome-exploit-development

This is a curated list of resources for learning about exploit development, not an exploit itself. It is a collection of books, tutorials, courses, tools, and vulnerable applications for learning about exploit development. The resources include books such as "Hacking - The art of exploitation" an...