cvelistv5 - cve-2025-64484

CVE-2025-64484 (GCVE-0-2025-64484)

Vulnerability from cvelistv5 – Published: 2025-11-10 21:33 – Updated: 2025-11-14 19:24

Summary

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.

Severity ?

8.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

CWE

CWE-644 - Improper Neutralization of HTTP Headers for Scripting Syntax

Assigner

GitHub_M

References

URL

Tags

	https://github.com/oauth2-proxy/oauth2-proxy/secu…	x_refsource_CONFIRM
	https://datatracker.ietf.org/doc/html/rfc2616#sec…	x_refsource_MISC
	https://datatracker.ietf.org/doc/html/rfc822#sect…	x_refsource_MISC
	https://github.security.telekom.com/2020/05/smugg…	x_refsource_MISC
	https://www.uptimia.com/questions/why-are-http-he…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	oauth2-proxy	oauth2-proxy	Affected: < 7.13.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-64484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-14T19:24:50.300456Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-14T19:24:55.471Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oauth2-proxy",
          "vendor": "oauth2-proxy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy\u2019s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don\u0027t treat underscores and hyphens in Headers the same way."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-644",
              "description": "CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-10T21:33:58.018Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6"
        },
        {
          "name": "https://datatracker.ietf.org/doc/html/rfc2616#section-4.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc2616#section-4.2"
        },
        {
          "name": "https://datatracker.ietf.org/doc/html/rfc822#section-3.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://datatracker.ietf.org/doc/html/rfc822#section-3.2"
        },
        {
          "name": "https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html"
        },
        {
          "name": "https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"
        }
      ],
      "source": {
        "advisory": "GHSA-vjrc-mh2v-45x6",
        "discovery": "UNKNOWN"
      },
      "title": "OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-64484",
    "datePublished": "2025-11-10T21:33:58.018Z",
    "dateReserved": "2025-11-05T19:12:25.102Z",
    "dateUpdated": "2025-11-14T19:24:55.471Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-64484\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-11-10T22:15:37.490\",\"lastModified\":\"2025-11-12T16:19:59.103\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy\u2019s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don\u0027t treat underscores and hyphens in Headers the same way.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N\",\"baseScore\":8.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.1,\"impactScore\":4.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-644\"}]}],\"references\":[{\"url\":\"https://datatracker.ietf.org/doc/html/rfc2616#section-4.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://datatracker.ietf.org/doc/html/rfc822#section-3.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-64484\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-11-14T19:24:50.300456Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-11-14T19:24:52.936Z\"}}], \"cna\": {\"title\": \"OAuth2-Proxy vulnerable to header smuggling via underscore, leading to potential privilege escalation\", \"source\": {\"advisory\": \"GHSA-vjrc-mh2v-45x6\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"oauth2-proxy\", \"product\": \"oauth2-proxy\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 7.13.0\"}]}], \"references\": [{\"url\": \"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6\", \"name\": \"https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc2616#section-4.2\", \"name\": \"https://datatracker.ietf.org/doc/html/rfc2616#section-4.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://datatracker.ietf.org/doc/html/rfc822#section-3.2\", \"name\": \"https://datatracker.ietf.org/doc/html/rfc822#section-3.2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html\", \"name\": \"https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx\", \"name\": \"https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy\\u2019s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don\u0027t treat underscores and hyphens in Headers the same way.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-644\", \"description\": \"CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-11-10T21:33:58.018Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-64484\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-14T19:24:55.471Z\", \"dateReserved\": \"2025-11-05T19:12:25.102Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-11-10T21:33:58.018Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-VJRC-MH2V-45X6

Vulnerability from github – Published: 2025-11-12 21:42 – Updated: 2025-11-17 21:48

Summary

OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation

Details

Impact

All deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications).

Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy’s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised.

Patches

This change mitigates a request header smuggling vulnerability where an attacker could bypass header stripping by using different capitalization or replacing dashes with underscores. The problem has been patched with v7.13.0.

By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both X-Forwarded-For and X_Forwarded-for will now be treated as equivalent and stripped away.

However, if users have a rationale for keeping a similar-looking header and don't want to strip it, a new configuration field for headers managed through AlphaConfig called InsecureSkipHeaderNormalization has been introduced :

// Header represents an individual header that will be added to a request or
// response header.
type Header struct {
    // Name is the header name to be used for this set of values.
    // Names should be unique within a list of Headers.
    Name string `json:"name,omitempty"`

    // PreserveRequestValue determines whether any values for this header
    // should be preserved for the request to the upstream server.
    // This option only applies to injected request headers.
    // Defaults to false (headers that match this header will be stripped).
    PreserveRequestValue bool `json:"preserveRequestValue,omitempty"`

    // InsecureSkipHeaderNormalization disables normalizing the header name
    // According to RFC 7230 Section 3.2 there aren't any rules about
    // capitalization of header names, but the standard practice is to use
    // Title-Case (e.g. X-Forwarded-For). By default, header names will be
    // normalized to Title-Case and any incoming headers that match will be
    // treated as the same header. Additionally underscores (_) in header names
    // will be converted to dashes (-) when normalizing.
    // Defaults to false (header names will be normalized).
    InsecureSkipHeaderNormalization bool `json:"InsecureSkipHeaderNormalization,omitempty"`

    // Values contains the desired values for this header
    Values []HeaderValue `json:"values,omitempty"`
}

Workarounds

Ensure filtering and processing logic in upstream services don't treat underscores and hyphens in Headers the same way.

Severity ?

8.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/oauth2-proxy/oauth2-proxy/v7"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-644"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-12T21:42:36Z",
    "nvd_published_at": "2025-11-10T22:15:37Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nAll deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications).\n\nAuthenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy\u2019s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised.\n\n### Patches\n\nThis change mitigates a request header smuggling vulnerability where an attacker could bypass header stripping by using different capitalization or replacing dashes with underscores. The problem has been patched with v7.13.0.\n\nBy default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away.\n\nHowever, if users have a rationale for keeping a similar-looking header and don\u0027t want to strip it, a new configuration field for headers managed through AlphaConfig called InsecureSkipHeaderNormalization has been introduced :\n\n```golang\n// Header represents an individual header that will be added to a request or\n// response header.\ntype Header struct {\n\t// Name is the header name to be used for this set of values.\n\t// Names should be unique within a list of Headers.\n\tName string `json:\"name,omitempty\"`\n\n\t// PreserveRequestValue determines whether any values for this header\n\t// should be preserved for the request to the upstream server.\n\t// This option only applies to injected request headers.\n\t// Defaults to false (headers that match this header will be stripped).\n\tPreserveRequestValue bool `json:\"preserveRequestValue,omitempty\"`\n\n\t// InsecureSkipHeaderNormalization disables normalizing the header name\n\t// According to RFC 7230 Section 3.2 there aren\u0027t any rules about\n\t// capitalization of header names, but the standard practice is to use\n\t// Title-Case (e.g. X-Forwarded-For). By default, header names will be\n\t// normalized to Title-Case and any incoming headers that match will be\n\t// treated as the same header. Additionally underscores (_) in header names\n\t// will be converted to dashes (-) when normalizing.\n\t// Defaults to false (header names will be normalized).\n\tInsecureSkipHeaderNormalization bool `json:\"InsecureSkipHeaderNormalization,omitempty\"`\n\n\t// Values contains the desired values for this header\n\tValues []HeaderValue `json:\"values,omitempty\"`\n}\n```\n\n### Workarounds\nEnsure filtering and processing logic in upstream services don\u0027t treat underscores and hyphens in Headers the same way.",
  "id": "GHSA-vjrc-mh2v-45x6",
  "modified": "2025-11-17T21:48:56Z",
  "published": "2025-11-12T21:42:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64484"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/commit/f3f30fa976fb4bb97d6345ba4735cb6d86e24f95"
    },
    {
      "type": "WEB",
      "url": "https://datatracker.ietf.org/doc/html/rfc2616#section-4.2"
    },
    {
      "type": "WEB",
      "url": "https://datatracker.ietf.org/doc/html/rfc822#section-3.2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/releases/tag/v7.13.0"
    },
    {
      "type": "WEB",
      "url": "https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html"
    },
    {
      "type": "WEB",
      "url": "https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation"
}

FKIE_CVE-2025-64484

Vulnerability from fkie_nvd - Published: 2025-11-10 22:15 - Updated: 2025-11-12 16:19

Severity ?

8.5 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://datatracker.ietf.org/doc/html/rfc2616#section-4.2
	security-advisories@github.com	https://datatracker.ietf.org/doc/html/rfc822#section-3.2
	security-advisories@github.com	https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6
	security-advisories@github.com	https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html
	security-advisories@github.com	https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. In versions prior to 7.13.0, all deployments of OAuth2 Proxy in front of applications that normalize underscores to dashes in HTTP headers (e.g., WSGI-based frameworks such as Django, Flask, FastAPI, and PHP applications). Authenticated users can inject underscore variants of X-Forwarded-* headers that bypass the proxy\u2019s filtering logic, potentially escalating privileges in the upstream app. OAuth2 Proxy authentication/authorization itself is not compromised. The problem has been patched with v7.13.0. By default all specified headers will now be normalized, meaning that both capitalization and the use of underscores (_) versus dashes (-) will be ignored when matching headers to be stripped. For example, both `X-Forwarded-For` and `X_Forwarded-for` will now be treated as equivalent and stripped away. For those who have a rational that requires keeping a similar looking header and not stripping it, the maintainers introduced a new configuration field for Headers managed through the AlphaConfig called `InsecureSkipHeaderNormalization`. As a workaround, ensure filtering and processing logic in upstream services don\u0027t treat underscores and hyphens in Headers the same way."
    },
    {
      "lang": "es",
      "value": "OAuth2-Proxy es una herramienta de c\u00f3digo abierto que puede funcionar como un proxy inverso independiente o como un componente de middleware integrado en configuraciones de proxy inverso o balanceador de carga existentes. En versiones anteriores a la 7.13.0, todas las implementaciones de OAuth2 Proxy delante de aplicaciones que normalizan los guiones bajos a guiones en los encabezados HTTP (por ejemplo, frameworks basados en WSGI como Django, Flask, FastAPI y aplicaciones PHP). Los usuarios autenticados pueden inyectar variantes con guion bajo de los encabezados X-Forwarded-* que eluden la l\u00f3gica de filtrado del proxy, lo que podr\u00eda escalar privilegios en la aplicaci\u00f3n upstream. La autenticaci\u00f3n/autorizaci\u00f3n de OAuth2 Proxy en s\u00ed misma no est\u00e1 comprometida. El problema ha sido parcheado con la v7.13.0. Por defecto, todos los encabezados especificados ahora ser\u00e1n normalizados, lo que significa que tanto la capitalizaci\u00f3n como el uso de guiones bajos (_) frente a guiones (-) ser\u00e1n ignorados al hacer coincidir los encabezados a eliminar. Por ejemplo, tanto \u0027X-Forwarded-For\u0027 como \u0027X_Forwarded-for\u0027 ahora ser\u00e1n tratados como equivalentes y eliminados. Para aquellos que tienen una raz\u00f3n que requiere mantener un encabezado de apariencia similar y no eliminarlo, los mantenedores introdujeron un nuevo campo de configuraci\u00f3n para los encabezados gestionados a trav\u00e9s de AlphaConfig llamado \u0027InsecureSkipHeaderNormalization\u0027. Como soluci\u00f3n alternativa, aseg\u00farese de que la l\u00f3gica de filtrado y procesamiento en los servicios upstream no trate los guiones bajos y los guiones en los encabezados de la misma manera."
    }
  ],
  "id": "CVE-2025-64484",
  "lastModified": "2025-11-12T16:19:59.103",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-11-10T22:15:37.490",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://datatracker.ietf.org/doc/html/rfc2616#section-4.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://datatracker.ietf.org/doc/html/rfc822#section-3.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-vjrc-mh2v-45x6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.security.telekom.com/2020/05/smuggling-http-headers-through-reverse-proxies.html"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://www.uptimia.com/questions/why-are-http-headers-with-underscores-dropped-by-nginx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-644"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-64484 (GCVE-0-2025-64484)

GHSA-VJRC-MH2V-45X6

Impact

Patches

Workarounds

FKIE_CVE-2025-64484

Tags

Sightings

Nomenclature