CVE-2026-21826: HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection
HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure the application to validate and enforce allowed Host header values. Reject or canonicalize requests where the Host header does not match the expected hostname(s) used by your deployment.
HCL Digital Experience / HCL Digital Experience Compose host_header_validation = enabled / restrict to expected hostnames - Configuration
Configure the fronting web server or reverse proxy to reject requests with unexpected Host headers or to rewrite the Host header to the canonical hostname before passing the request to the application.
Web server / reverse proxy (fronting HCL Digital Experience) host header enforcement / rewrite = enforce expected host or rewrite to canonical host - Compensating control
Deploy WAF or web/proxy filtering rules to detect and block requests with manipulated or unexpected Host headers, and restrict direct access to application servers so only the trusted front-end can reach them.
- Operational
Monitor and review web server and application logs for requests containing unexpected or suspicious Host header values; investigate any anomalies and apply incident response as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21826?
The severity of CVE-2026-21826 is rated as medium with a score of 6.1.
What risk does CVE-2026-21826 pose?
CVE-2026-21826 poses a risk of host header injection that could lead to unexpected application behavior.
How can I fix CVE-2026-21826?
To fix CVE-2026-21826, ensure proper validation and sanitization of the Host header in your application.
What software is affected by CVE-2026-21826?
CVE-2026-21826 affects HCL Digital Experience and HCL Digital Experience Compose.
What type of attack is associated with CVE-2026-21826?
CVE-2026-21826 is associated with host header injection attacks.