Skip to content
OpenAdvisories

Package · Go

github.com/fabiolb/fabio

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 5.8
    CVE-2026-62987

    Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

    Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHea…

    fabiolb fabio consul github.com/fabiolb/fabio Ubuntu Go
  • Critical 9.1
    CVE-2025-48865

    Fabio allows HTTP clients to manipulate custom headers it adds

    Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how it processes hop-by-hop headers. Fabio adds HTTP…

    fabiolb fabio github.com/fabiolb/fabio Go