Description

A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T12:16:29.887Z",
  "pubdate": "2026-08-28T12:16:29.887Z",
  "executiveSummary": "This vulnerability involves a Denial of Service (DoS) condition triggered by improper input validation during the handling of forwarding information from trusted proxy hosts.\nWhen a configured trusted proxy transmits a payload containing a NUL byte, the application's login process experiences an unhandled exception or critical failure, leading to immediate process termination.\nThe vulnerability affects deployments that utilize the trusted proxy configuration feature, as the flaw relies on the system trust relationship established with the proxy source.\nThe primary impact is service degradation or complete denial of service for authentication services, preventing legitimate users from accessing the system during subsequent login attempts.\nSuccessful exploitation requires the attacker to either compromise an existing trusted proxy host or have control over a network segment permitted to act as a proxy for the affected product.\nWhile no public exploits are documented, the barrier to entry is the established trust relationship; once a host is marked as trusted, it possesses the capability to inject the malicious payload into the login sequence.",
  "technicalDetails": "The root cause of the vulnerability resides in the application's input sanitization routine when processing headers or forwarding metadata transmitted from a verified trusted proxy. The application fails to anticipate or neutralize a NUL byte character embedded within the forwarding information strings.\nDuring the login handshake or subsequent authentication flow, the system reads the proxy-provided headers to ascertain the originating client information. When the input processing logic encounters a NUL byte, the underlying handling function likely experiences a buffer handling error, memory management corruption, or a logic branch failure caused by the unexpected termination character in the string buffer.\nThe attack flow follows a structured progression: First, the attacker identifies a host currently listed in the application's trusted proxy whitelist. Second, the attacker sends a crafted request through this proxy, inserting a NUL byte into the relevant forwarding header (e.g., X-Forwarded-For or similar proxy-related headers).\nUpon receipt of this request, the application’s login module attempts to parse the malicious header. The presence of the NUL byte interrupts the string processing flow, causing the login process to crash. The termination of this process prevents the application from initializing or handling subsequent authentication requests, effectively forcing the service into an unavailable state.\nThe vulnerability is specific to the login process and is categorized as a service disruption flaw. Because the application blindly trusts the incoming headers from the designated proxy, there is a lack of deep packet inspection or character filtering before the data reaches the vulnerable processing function.\nThe exploitation does not necessarily require the attacker to be authenticated, provided they can reach the login interface through the proxy or can manipulate the proxy to forward the malicious payload. The post-exploitation impact is limited to the exhaustion of authentication availability, as the crash interrupts the execution context of the authentication service, requiring administrative intervention or service restart to recover functionality."
}