fabiolb vulnerabilities

Products

• github.com/fabiolb/fabio 2

Latest fabiolb CVEs

Newest publication first

1. CVE-2026-62987 Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

   Published 2026-09-21

   Medium·CVSS 5.8 EPSS 0.20%

   Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and R...

2. CVE-2025-48865 Fabio allows HTTP clients to manipulate custom headers it adds

   Published 2025-05-30

   Critical·CVSS 9.1 EPSS 0.47%

   Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwa...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.