GHSA-W9MR-28MW-J8HG

Workarounds

The downstream server should handle the case that an expected header is not set by responding with an appropriate error.

References

See background info in https://github.com/golang/go/issues/50580

Downstream services relying on the presence of headers set by the header mutator could be exploited. A client can drop the header set by the header mutator by including that header's name in the Connection header. Example minimal config:

- id: 'example'
  upstream:
    url: 'https://example.com'
  match:
    url: 'http://127.0.0.1:4455/'
    methods:
      - GET
  authenticators:
    - handler: anonymous
  authorizer:
    handler: allow
  mutators:
    - handler: header
      config:
        headers:
          X-Subject: {{ .Subject }}

curl -H "Connection: close,x-subject" http://127.0.0.1:4455/

The X-Subject header will not arrive at the downstream server. It is completely dropped. In case the downstream server handles such a request in an unexpected way, an attacker can exploit this, assuming they know or guess the internal header name.

Kodem intelligence

c5cc7f736dc84185034be4356057d1c7a656d797

1. What is GHSA-W9MR-28MW-J8HG? GHSA-W9MR-28MW-J8HG is a low-severity security vulnerability in github.com/ory/oathkeeper (go), affecting versions < 0.40.3. It is fixed in 0.40.3.
2. Which versions of github.com/ory/oathkeeper are affected by GHSA-W9MR-28MW-J8HG? github.com/ory/oathkeeper (go) versions < 0.40.3 is affected.
3. Is there a fix for GHSA-W9MR-28MW-J8HG? Yes. GHSA-W9MR-28MW-J8HG is fixed in 0.40.3. Upgrade to this version or later.
4. Is GHSA-W9MR-28MW-J8HG exploitable, and should I be worried? Whether GHSA-W9MR-28MW-J8HG is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether GHSA-W9MR-28MW-J8HG is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix GHSA-W9MR-28MW-J8HG? Upgrade github.com/ory/oathkeeper to 0.40.3 or later.