CVE-2026-42395: Medium severity vulnerability
A host listed as a trusted proxy can send forwarding information containing a NUL byte, which crashes the login process on the following login attempt. The login process is terminated, which can cause degradation or denial of service for logins. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict the list of trusted proxy networks to hosts that are fully under your control (deployments without trusted proxies are not affected).
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments that configure trusted proxies are affected. Deployments without trusted proxies configured are not affected.
What does an attacker need to exploit this issue?
An attacker must be able to act through a host listed as a trusted proxy and send forwarding information containing a NUL byte. No authentication or user interaction is required.
What is the operational impact?
The malformed forwarding information causes the login process to crash on the following login attempt. This can degrade or deny login availability, but the provided severity vector indicates no confidentiality or integrity impact.
What mitigation is available before updating?
Restrict the trusted proxy network list to hosts that are fully under your control. Update to a non-vulnerable version when available.
Are public exploits known?
No publicly available exploits are known.