{"id":"CVE-2021-29479","aliases":["EUVD-2021-1496","GHSA-w6rq-6h34-vh7q"],"status":"published","title":"Cached redirect poisoning via X-Forwarded-Host header","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00857,"percentile":0.5885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-807"],"published":"2021-06-29T14:35:12Z","modified":"2026-10-20T10:54:37Z","fixes":[{"ecosystem":"Maven","package":"io.ratpack:ratpack-core","fixed_in":["1.9.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.ratpack:ratpack-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"io.ratpack:ratpack-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.0"}]}],"versions":["0.9.0","0.9.1","0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.16","0.9.17","0.9.18","0.9.19","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9","1.0.0","1.0.0-rc-1","1.0.0-rc-2","1.0.0-rc-3","1.1.0","1.1.1","1.2.0","1.2.0-RC-1","1.2.0-rc-2","1.3.0","1.3.0-rc-1","1.3.0-rc-2","1.3.1","1.3.2","1.3.3","1.4.0","1.4.0-rc-1","1.4.0-rc-2","1.4.0-rc-3","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.4.6","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.6.0","1.6.0-rc-1","1.6.0-rc-2","1.6.0-rc-3","1.6.0-rc-4","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.8.0","1.8.1","1.8.2","1.9.0-rc-1","1.9.0-rc-2"]}],"products":[{"vendor":"ratpack","product":"ratpack"},{"vendor":"ratpack_project","product":"ratpack"}],"references":[{"url":"https://portswigger.net/web-security/web-cache-poisoning","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7q","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-29479","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w6rq-6h34-vh7q"},{"url":"https://github.com/ratpack/ratpack","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-29479","title":"Cached redirect poisoning via X-Forwarded-Host header","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.","status":"published","published":"2021-06-29T14:35:12Z","modified":"2024-08-03T22:11:05.264Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-1496","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.","status":"published","published":"2021-06-29T14:35:12Z","modified":"2024-08-03T22:11:05Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-03T03:24:44.540278Z"}],"ghsa":[{"id":"GHSA-w6rq-6h34-vh7q","title":"Cached redirect poisoning via X-Forwarded-Host header","description":"A user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key.\n\nUsers are only vulnerable if they do not configure a custom `PublicAddress` instance. A custom `PublicAddress` can be specified by using [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-). For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable.\n\n### Impact\n\nThis can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.\n\n### Patches\n\nAs of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:\n\n1. The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port\n2. Relative redirects issued by the application are no longer absolutized; they are passed through as-is\n\n### Workarounds\n\nIn production, ensure that [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-) correctly configures the server.\n\n### References\n - https://portswigger.net/web-security/web-cache-poisoning","status":"published","published":"2021-07-01T17:02:38Z","modified":"2023-02-01T05:05:49Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T14:36:35.781528Z"}],"nvd":[{"id":"CVE-2021-29479","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.","status":"published","published":"2021-06-29T15:15:18.87Z","modified":"2026-06-17T03:47:43.63Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"CVE-2021-29479","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.","status":"published","published":"2021-06-29T15:15:18.87Z","modified":"2026-10-20T10:54:37.266305508Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"GHSA-w6rq-6h34-vh7q","title":"Cached redirect poisoning via X-Forwarded-Host header","description":"A user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key.\n\nUsers are only vulnerable if they do not configure a custom `PublicAddress` instance. A custom `PublicAddress` can be specified by using [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-). For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable.\n\n### Impact\n\nThis can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.\n\n### Patches\n\nAs of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:\n\n1. The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port\n2. Relative redirects issued by the application are no longer absolutized; they are passed through as-is\n\n### Workarounds\n\nIn production, ensure that [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-) correctly configures the server.\n\n### References\n - https://portswigger.net/web-security/web-cache-poisoning","status":"published","published":"2021-07-01T17:02:38Z","modified":"2026-07-08T06:29:24.395736755Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-807"],"updated_at":"2026-11-02T15:46:58.401149Z"}]}}