CVE-2026-31908

CriticalCVSS 9.1/10Last modified Oct 26, 2026

Description

Header injection vulnerability in Apache APISIX.

The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0.

Users are recommended to upgrade to version 3.16.0, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-75

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache APISIX	>= 2.12.0, <= 3.15.0

References

https://lists.apache.org/thread/sob643s5lztov7x579j8o0c444t36n6bMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/14/3Mailing List, Third Party Advisory

Timeline

Published: Apr 14, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-319097.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06.CVE-2026-31915.4The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due t CVE-2026-319107.5Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended CVE-2026-319115.5libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a cra CVE-2026-319125.5libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a ju CVE-2026-319138.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Trav CVE-2026-319146.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses CVE-2026-319155.3Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.T CVE-2026-319165.3Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Acce CVE-2026-319178.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection CVE-2026-319186.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in immonex immonex Kickstart immonex-kick CVE-2026-319194.3Missing Authorization vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free allows E