ANT-2026-DXGTQBSK
WebSocket default Origin check ignores scheme and port in HTTP.jl
Description
The default WebSocket Origin validator (_origin_allowed_default) only enforced the host component of the same-origin tuple. It never checked the Origin's scheme, and when the request Host header carried no explicit port (the norm for default-port 80/443 servers, where browsers omit the port) it fell through to a hostname-only comparison that discarded the Origin's port. As a result a wss://example.com server accepted cross-scheme/cross-port origins such as http://example.com or http://example.com:8080.
Impact
An attacker controlling another scheme or port on the same hostname could open an authenticated WebSocket from a victim's browser using the victim's cookies (cross-site WebSocket hijacking).
Patches
Fixed in HTTP.jl v2.4.0. _origin_allowed_default now requires the Origin's scheme to match the server transport and compares effective ports, substituting the scheme default port (443 when secure, else 80) when the Host header omits one and handling bracketed IPv6 literals. The server_secure flag is plumbed through all upgrade call sites; the empty-Origin allowance, cross-host rejection, and malformed-Origin rejection are preserved.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
What each source reports
OSVJLSEC-2026-614No score
WebSocket default Origin check ignores scheme and port in HTTP.jl
Description
The default WebSocket Origin validator (_origin_allowed_default) only enforced the host component of the same-origin tuple. It never checked the Origin's scheme, and when the request Host header carried no explicit port (the norm for default-port 80/443 servers, where browsers omit the port) it fell through to a hostname-only comparison that discarded the Origin's port. As a result a wss://example.com server accepted cross-scheme/cross-port origins such as http://example.com or http://example.com:8080.
Impact
An attacker controlling another scheme or port on the same hostname could open an authenticated WebSocket from a victim's browser using the victim's cookies (cross-site WebSocket hijacking).
Patches
Fixed in HTTP.jl v2.4.0. _origin_allowed_default now requires the Origin's scheme to match the server transport and compares effective ports, substituting the scheme default port (443 when secure, else 80) when the Host header omits one and handling bracketed IPv6 literals. The server_secure flag is plumbed through all upgrade call sites; the empty-Origin allowance, cross-host rejection, and malformed-Origin rejection are preserved.
Reported to the JuliaLang security team through Anthropic's Coordinated Vulnerability Disclosure program.
- Record
JLSEC-2026-614- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HTTPJulia | before 2.4.0 | 2.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
ANT-2026-DXGTQBSK is a vulnerability with no CVSS score yet in HTTP, published June 23, 2026. No source lists public exploit code. Fixed in HTTP 2.4.0.