{"id":"CVE-2026-21826","aliases":["EUVD-2026-34787","GHSA-xg6r-cjq3-qmj5"],"status":"published","title":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection","description":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00144,"percentile":0.03746,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-601"],"published":"2026-06-05T05:58:31Z","modified":"2026-07-23T07:10:00Z","products":[{"vendor":"hclsoftware","product":"digital experience \u0026 dx compose"},{"vendor":"hcltech","product":"digital_experience"},{"vendor":"hcltech","product":"digital_experience_compose"}],"references":[{"url":"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0130849","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21826"},{"url":"https://github.com/advisories/GHSA-xg6r-cjq3-qmj5"}],"sources":{"cve":[{"id":"CVE-2026-21826","title":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection","description":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.","status":"published","published":"2026-06-05T05:58:31.449Z","modified":"2026-06-09T14:38:10.191Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-34787","description":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.","status":"published","published":"2026-06-05T05:58:31Z","modified":"2026-06-09T14:38:10Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:47.64718Z"}],"ghsa":[{"id":"GHSA-xg6r-cjq3-qmj5","title":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header...","description":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.","status":"published","published":"2026-06-05T09:33:46Z","modified":"2026-06-05T09:33:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:08:34.365209Z"}],"nvd":[{"id":"CVE-2026-21826","description":"HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection.  An attacker can manipulate the Host header and cause the application to behave in unexpected ways.","status":"published","published":"2026-06-05T07:16:29.883Z","modified":"2026-07-23T07:10:00.113Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:12:22.371367Z"}]}}