# CWE-644.

Every Advisory and CVE whose sources give the weakness CWE-644, newest first.

## Records, newest first

- [Authentication bypass by spoofing in Eclipse Foundation Eclipse Connected Services Platform](https://agentprime.io/advisories/CVE-2026-110723.md)
  `CVE-2026-110723` · CVE record: Eclipse Foundation Eclipse Connected Services Platform · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, CWE-644
- [Monkeytype: Rate-limit and anti-brute-force controls bypassable via spoofed HTTP headers (forgotPasswordEmail/verificationEmail mail bombing and badAuth bypass)](https://agentprime.io/advisories/CVE-2026-69183.md)
  `CVE-2026-69183` · CVE record: monkeytypegame monkeytype · CVSS 7.5 High · Not analysed yet · Published 20 Aug 2026 · Tags: Authentication bypass, CWE-644
- [Genkit improper host header validation](https://agentprime.io/advisories/CVE-2026-67179.md)
  `CVE-2026-67179` · CVE record: genkit-ai genkit · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-644
- [Multiple vulnerabilities in SAP Business AI Platform (Approuter)](https://agentprime.io/advisories/CVE-2026-66778.md)
  `CVE-2026-66778` · CVE record: SAP_SE SAP Business AI Platform (Approuter) · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: CWE-644
- [picocms Pico - Host Header Injection Enables Script Source Hijacking](https://agentprime.io/advisories/CVE-2026-72574.md)
  `CVE-2026-72574` · CVE record: picocms Pico · CVSS 6.1 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: CWE-644
- [SonicWall SonicOS: A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS…](https://agentprime.io/advisories/CVE-2026-0516.md)
  `CVE-2026-0516` · CVE record: SonicWall SonicOS · CVSS 6.5 Medium · Not analysed yet · Published 5 Aug 2026 · Tags: CWE-644
- [Tornado vulnerable to Header Injection and XSS via reason argument](https://agentprime.io/advisories/GHSA-pr2v-jx2c-wg9f.md)
  `GHSA-pr2v-jx2c-wg9f`, `CVE-2025-67724`, `PYSEC-2025-265` · PyPI `tornado`: affected `<6.5.3`, fixed in `6.5.3` · CVSS 5.4 Medium · Not analysed yet · Published 20 Jul 2026 · Tags: Cross-site scripting (XSS), CWE-644
- [Missing HTTP Security Headers in DevOps Loop](https://agentprime.io/advisories/CVE-2026-21762.md)
  `CVE-2026-21762` · CVE record: HCLSoftware DevOps Loop · CVSS 3.7 Low · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-644
- [Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax](https://agentprime.io/advisories/CVE-2026-54477.md)
  `CVE-2026-54477` · CVE record: Gardyn Gardyn Home Firmware and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 2 Jul 2026 · Tags: CWE-644
- [Algernon: Host header path traversal in --domain mode reads files and runs Lua from parent dir](https://agentprime.io/advisories/GHSA-jc3j-x6pg-4hmv.md)
  `GHSA-jc3j-x6pg-4hmv`, `CVE-2026-48126`, `GO-2026-5460` · Go `github.com/xyproto/algernon`: affected `<1.17.8`, fixed in `1.17.8` · CVSS 8.2 High · Not analysed yet · Published 23 Jun 2026 · Tags: Path traversal, CWE-644
- [IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities Host Header Injection observed](https://agentprime.io/advisories/CVE-2024-51454.md)
  `CVE-2024-51454` · CVE record: IBM Engineering Workflow Management · CVSS 6.5 Medium · Not analysed yet · Published 22 Jun 2026 · Tags: CWE-644
- [Craft CMS: Blind SSRF and Arbitrary JavaScript Injection via Host Header Poisoning in actionResourceJs](https://agentprime.io/advisories/GHSA-c55v-343g-5xff.md)
  `GHSA-c55v-343g-5xff`, `CVE-2026-55791`, `PKSA-5xds-5mf3-ckxn` · Packagist `craftcms/cms`: affected `>=4.0.0-RC1, <4.18 || >=5.0.0-RC1, <5.10`, fixed in `4.18`, `5.10` · CVSS 6.9 Medium · Not analysed yet · Published 19 Jun 2026 · Tags: Cross-site scripting (XSS), Server-side request forgery (SSRF), CWE-346, CWE-644
- [Improper neutralization of HTTP headers in Password Manager](https://agentprime.io/advisories/CVE-2026-10836.md)
  `CVE-2026-10836` · CVE record: Password Manager Password Manager · CVSS 5.1 Medium · Not analysed yet · Published 17 Jun 2026 · Tags: CWE-644
- [A vulnerability has been identified in IBM DevOps Plan that allows a Host Header Injection attack due to improper handling of the Host header in HTTP requests.](https://agentprime.io/advisories/CVE-2026-4096.md)
  `CVE-2026-4096` · CVE record: IBM DevOps Plan · CVSS 6.5 Medium · Not analysed yet · Published 11 Jun 2026 · Tags: CWE-644
- [Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host header](https://agentprime.io/advisories/GHSA-3qmc-cj7q-62hv.md)
  `GHSA-3qmc-cj7q-62hv`, `CVE-2026-48061`, `PYSEC-2026-2603` · PyPI `litestar`: affected `<2.22.0`, fixed in `2.22.0` · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2026 · Tags: CWE-348, CWE-644, CWE-807
- [Fastify's connection header abuse enables stripping of proxy-added headers](https://agentprime.io/advisories/GHSA-gwhp-pf74-vj37.md)
  `GHSA-gwhp-pf74-vj37`, `CVE-2026-33805` · npm `@fastify/http-proxy` and 1 more: affected `<11.4.4`, fixed in `11.4.4` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Apr 2026 · Tags: HTTP request smuggling, CWE-644
- [Multiple vulnerabilities have been addressed in IBM Aspera Shares](https://agentprime.io/advisories/CVE-2025-66485.md)
  `CVE-2025-66485` · CVE record: IBM Aspera Shares · CVSS 5.4 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: CWE-644
- [Tandoor Recipes Vulnerable to Host Header Injection](https://agentprime.io/advisories/CVE-2026-33149.md)
  `CVE-2026-33149` · CVE record: TandoorRecipes recipes · CVSS 8.1 High · Not analysed yet · Published 26 Mar 2026 · Tags: CWE-644
- [IBM InfoSphere Information Server is vulnerable to HTTP header injection](https://agentprime.io/advisories/CVE-2025-14807.md)
  `CVE-2025-14807` · CVE record: IBM InfoSphere Information Server · CVSS 6.5 Medium · Not analysed yet · Published 25 Mar 2026 · Tags: CWE-644
- [Multiple vulnerabilities in IBM Aspera Orchestrator](https://agentprime.io/advisories/CVE-2025-13213.md)
  `CVE-2025-13213` · CVE record: IBM Aspera Orchestrator · CVSS 5.4 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-644
- [Multiple vulnerabilities in IBM Aspera Faspex](https://agentprime.io/advisories/CVE-2025-36227.md)
  `CVE-2025-36227` · CVE record: IBM Aspera Faspex 5 · CVSS 5.4 Medium · Not analysed yet · Published 10 Mar 2026 · Tags: CWE-644
- [@perfood/couch-auth has a host header injection vulnerability](https://agentprime.io/advisories/GHSA-qw8v-34ww-6q9p.md)
  `GHSA-qw8v-34ww-6q9p`, `CVE-2025-70948` · npm `@perfood/couch-auth`: affected `<=0.26.0`, no fixed version yet · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: Other injection, CWE-644
- [HTTP Host header vulnerability in WebClient and WebScheduler web apps](https://agentprime.io/advisories/CVE-2026-1698.md)
  `CVE-2026-1698` · CVE record: arcinfo PcVue · CVSS 5.3 Medium · Not analysed yet · Published 26 Feb 2026 · Tags: CWE-644
- [A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServiceProvider.php, combined with the default misconfiguration where…](https://agentprime.io/advisories/CVE-2026-26747.md)
  `CVE-2026-26747` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Feb 2026 · Tags: CWE-644
- [Multiple vulnerabilities in IBM Java SDK affecting Db2 Recovery Expert for Linux, Unix and Windows](https://agentprime.io/advisories/CVE-2025-27901.md)
  `CVE-2025-27901` · CVE record: IBM DB2 Recovery Expert for LUW · CVSS 6.5 Medium · Not analysed yet · Published 17 Feb 2026 · Tags: CWE-644
- [JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax](https://agentprime.io/advisories/CVE-2026-26234.md)
  `CVE-2026-26234` · CVE record: ALBRECHT JUNG GMBH & CO. KG JUNG Smart Visu Server · CVSS 8.7 High · Not analysed yet · Published 12 Feb 2026 · Tags: CWE-644
- [Multiple Vulnerabilities in IBM Concert Software](https://agentprime.io/advisories/CVE-2024-51451.md)
  `CVE-2024-51451` · CVE record: IBM Concert · CVSS 6.5 Medium · Not analysed yet · Published 4 Feb 2026 · Tags: CWE-644
- [HCL AION is affected by an Host Header Injection vulnerability](https://agentprime.io/advisories/CVE-2025-52660.md)
  `CVE-2025-52660` · CVE record: HCL Software AION · CVSS 2.7 Low · Not analysed yet · Published 19 Jan 2026 · Tags: CWE-644
- [Coolify has host header injection in forgot password](https://agentprime.io/advisories/CVE-2025-64425.md)
  `CVE-2025-64425` · CVE record: coollabsio coolify · CVSS 8.5 High · Not analysed yet · Published 5 Jan 2026 · Tags: CWE-644
- [MediaCrush Header paths.py http headers for scripting syntax](https://agentprime.io/advisories/CVE-2025-13803.md)
  `CVE-2025-13803` · CVE record: MediaCrush · CVSS 6.9 Medium · Not analysed yet · Published 1 Dec 2025 · Tags: CWE-644
- [jameschz Hush Framework HTTP Host Header Util.php http headers for scripting syntax](https://agentprime.io/advisories/CVE-2025-13434.md)
  `CVE-2025-13434` · CVE record: jameschz Hush Framework · CVSS 6.9 Medium · Not analysed yet · Published 20 Nov 2025 · Tags: CWE-644
- [Backdrop CMS Host Header Injection vulnerability](https://agentprime.io/advisories/GHSA-ffpg-gm3h-4p5p.md)
  `GHSA-ffpg-gm3h-4p5p`, `CVE-2025-63828`, `PKSA-2f77-cwcx-9j4j` · Packagist `backdrop/backdrop`: affected `<=1.32.0`, no fixed version yet · CVSS 6.1 Medium · Not analysed yet · Published 18 Nov 2025 · Tags: Open redirect, CWE-644
- [OAuth2-Proxy is vulnerable to header smuggling via underscore leading to potential privilege escalation in github.com/oauth2-proxy/oauth2-proxy](https://agentprime.io/advisories/GHSA-vjrc-mh2v-45x6.md)
  `GHSA-vjrc-mh2v-45x6`, `BIT-oauth2-proxy-2025-64484`, `CVE-2025-64484`, `GO-2025-4113` · Go `github.com/oauth2-proxy/oauth2-proxy` and 1 more: affected `*`, no fixed version yet · CVSS 8.5 High · Not analysed yet · Published 17 Nov 2025 · Tags: CWE-644
- [IBM OpenPages Host Header Injection](https://agentprime.io/advisories/CVE-2025-36223.md)
  `CVE-2025-36223` · CVE record: IBM OpenPages · CVSS 5.4 Medium · Not analysed yet · Published 12 Nov 2025 · Tags: CWE-644
- [HCL BigFix WebUI is affected by a host header poisoning vulnerability](https://agentprime.io/advisories/CVE-2025-52647.md)
  `CVE-2025-52647` · CVE record: HCL Software BigFix WebUI · CVSS 6.1 Medium · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-644
- [IBM SmartCloud Analytics - Log Analysis HOST header injection](https://agentprime.io/advisories/CVE-2024-40686.md)
  `CVE-2024-40686` · CVE record: IBM SmartCloud Analytics Log Analysis · CVSS 5.4 Medium · Not analysed yet · Published 23 Jul 2025 · Tags: CWE-644
- [HTTP host header injection vulnerability in IceWarp Mail Server](https://agentprime.io/advisories/CVE-2025-40631.md)
  `CVE-2025-40631` · CVE record: Icewarp Icewarp Mail Server · CVSS 2.0 Low · Not analysed yet · Published 16 May 2025 · Tags: CWE-644
- [A vulnerability in the web application of ctrlX OS allows a remote unauthenticated attacker to conduct various attacks against users of the vulnerable system, including web cache poisoning or Man-in-…](https://agentprime.io/advisories/CVE-2025-24339.md)
  `CVE-2025-24339` · CVE record: Bosch Rexroth AG ctrlX OS - Device Admin · CVSS 5.0 Medium · Not analysed yet · Published 30 Apr 2025 · Tags: CWE-644
- [IBM i improper HTTP header neutralization](https://agentprime.io/advisories/CVE-2025-2950.md)
  `CVE-2025-2950` · CVE record: IBM i · CVSS 5.4 Medium · Not analysed yet · Published 18 Apr 2025 · Tags: CWE-644
- [IBM Aspera Console HTTP header injection](https://agentprime.io/advisories/CVE-2022-43847.md)
  `CVE-2022-43847` · CVE record: IBM Aspera Console · CVSS 5.4 Medium · Not analysed yet · Published 14 Apr 2025 · Tags: CWE-644
- [IBM TXSeries for Multiplatforms information disclosure](https://agentprime.io/advisories/CVE-2025-0154.md)
  `CVE-2025-0154` · CVE record: IBM TXSeries for Multiplatforms · CVSS 5.3 Medium · Not analysed yet · Published 2 Apr 2025 · Tags: CWE-644
- [Hitachi Energy TRMTracker: A Host Header Injection vulnerability in TRMTracker application may allow an attacker by…](https://agentprime.io/advisories/CVE-2025-27632.md)
  `CVE-2025-27632` · CVE record: Hitachi Energy TRMTracker · CVSS 6.1 Medium · Not analysed yet · Published 25 Mar 2025 · Tags: CWE-644
- [IBM Control Center HOST header injection](https://agentprime.io/advisories/CVE-2023-35894.md)
  `CVE-2023-35894` · CVE record: IBM Control Center · CVSS 5.4 Medium · Not analysed yet · Published 7 Mar 2025 · Tags: CWE-644
- [Cache Poisoning through header manipulation vulnerability in SAP Fiori for SAP ERP](https://agentprime.io/advisories/CVE-2025-23191.md)
  `CVE-2025-23191` · CVE record: SAP_SE SAP Fiori for SAP ERP · CVSS 3.1 Low · Not analysed yet · Published 11 Feb 2025 · Tags: CWE-644
- [A Host header injection vulnerability exists in CTFd 3.7.5, due to the application failing to properly validate or sanitize the Host header.](https://agentprime.io/advisories/CVE-2025-23001.md)
  `CVE-2025-23001` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-644
- [HCL Nomad server on Domino is affected by a host header injection vulnerability](https://agentprime.io/advisories/CVE-2024-30129.md)
  `CVE-2024-30129` · CVE record: HCL Software Nomad server on Domino · CVSS 5.3 Medium · Not analysed yet · Published 6 Dec 2024 · Tags: CWE-644
- [Hashicorp Consul Improper Neutralization of HTTP Headers for Scripting Syntax vulnerability](https://agentprime.io/advisories/GHSA-5c4w-8hhh-3c3h.md)
  `GHSA-5c4w-8hhh-3c3h`, `BIT-consul-2024-10006`, `CVE-2024-10006`, `GO-2024-3241` · Go `github.com/hashicorp/consul`: affected `>=1.9.0, <1.20.1`, fixed in `1.20.1` · CVSS 8.3 High · Not analysed yet · Published 31 Oct 2024 · Tags: CWE-116, CWE-644
- [Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers.](https://agentprime.io/advisories/CVE-2024-47549.md)
  `CVE-2024-47549` · CVE record: Sharp Corporation Sharp Digital Full-color MFPs and Monochrome MFPs and 3 more · CVSS 7.4 High · Not analysed yet · Published 25 Oct 2024 · Tags: CWE-644
- [IBM Aspera Orchestrator HTTP header injection](https://agentprime.io/advisories/CVE-2023-26289.md)
  `CVE-2023-26289` · CVE record: IBM Aspera Orchestrator · CVSS 5.4 Medium · Not analysed yet · Published 30 Jul 2024 · Tags: CWE-644
- [IBM Datacap Navigator HTTP HOST header injection](https://agentprime.io/advisories/CVE-2024-39736.md)
  `CVE-2024-39736` · CVE record: IBM Datacap Navigator · CVSS 6.5 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-644
- [Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security](https://agentprime.io/advisories/GHSA-r969-783f-6jqr.md)
  `GHSA-r969-783f-6jqr`, `CVE-2024-21499`, `GO-2024-2562` · Go `github.com/greenpau/caddy-security`: affected `*`, no fixed version yet · CVSS 4.3 Medium · Not analysed yet · Published 28 Jun 2024 · Tags: CWE-644
- [IBM Aspera Faspex HTTP header injection](https://agentprime.io/advisories/CVE-2022-22399.md)
  `CVE-2022-22399` · CVE record: IBM Aspera Faspex · CVSS 5.4 Medium · Not analysed yet · Published 5 Mar 2024 · Tags: CWE-644
- [IBM Engineering Lifecycle Optimization HTTP header injection](https://agentprime.io/advisories/CVE-2023-45190.md)
  `CVE-2023-45190` · CVE record: IBM Engineering Lifecycle Optimization - Publishing · CVSS 5.1 Medium · Not analysed yet · Published 9 Feb 2024 · Tags: CWE-644
- [Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4](https://agentprime.io/advisories/CVE-2024-1064.md)
  `CVE-2024-1064` · CVE record: Arcadia Technology, LLC Crafty Controller · CVSS 7.5 High · Not analysed yet · Published 3 Feb 2024 · Tags: CWE-644
- [IBM Tivoli Application Dependency Discovery Manager HOST header injection](https://agentprime.io/advisories/CVE-2023-47143.md)
  `CVE-2023-47143` · CVE record: IBM Tivoli Application Dependency Discovery Manager · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-644
- [Spring HATEOAS vulnerable to Improper Neutralization of HTTP Headers for Scripting Syntax](https://agentprime.io/advisories/GHSA-7m5c-fgwf-mwph.md)
  `GHSA-7m5c-fgwf-mwph`, `CVE-2023-34036` · Maven `org.springframework.hateoas:spring-hateoas`: affected `<1.5.5 || >=2.0.0, <2.0.5 || >=2.1.0, <2.1.1`, fixed in `1.5.5`, `2.0.5`, `2.1.1` · CVSS 5.3 Medium · Not analysed yet · Published 17 Jul 2023 · Tags: CWE-116, CWE-644
- [Header Injection in SAP Solution Manager (Diagnostic Agent)](https://agentprime.io/advisories/CVE-2023-36921.md)
  `CVE-2023-36921` · CVE record: SAP_SE SAP Solution Manager (Diagnostic Agent) · CVSS 7.2 High · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-644
- [Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability.](https://agentprime.io/advisories/CVE-2023-32465.md)
  `CVE-2023-32465` · CVE record: Dell PowerProtect Cyber Recovery · CVSS 8.8 High · Not analysed yet · Published 14 Jun 2023 · Tags: CWE-644
- [Dell Data Protection Central: Dell EMC Data Protection Central, versions 19.1 through 19.7…](https://agentprime.io/advisories/CVE-2022-45102.md)
  `CVE-2022-45102` · CVE record: Dell Data Protection Central · CVSS 5.4 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-644
- [IBM API Connect HOST header injection](https://agentprime.io/advisories/CVE-2021-38997.md)
  `CVE-2021-38997` · CVE record: IBM API Connect · CVSS 5.4 Medium · Not analysed yet · Published 1 Dec 2022 · Tags: CWE-644

Older: <https://agentprime.io/advisories/tag/cwe-644.md?cursor=WyIyMDIyLTEyLTAxVDE3OjAwOjU5LjYwMjAwMFoiLCJDVkUtMjAyMS0zODk5NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-644>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-644/>. Everything for agents: <https://agentprime.io/llms.txt>.