CVE-2021-29479: Cached redirect poisoning via X-Forwarded-Host header in io.ratpack:ratpack-core
Summary
CVE-2021-29479: Cached redirect poisoning via X-Forwarded-Host header. Affects io.ratpack:ratpack-core versions < 1.9.0. Fixed in 1.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The io.ratpack:ratpack-core package is an open-source library that provides a lightweight, asynchronous web framework for building scalable applications in Java. It includes features such as routing, handling HTTP requests, and managing server configurations. However, versions prior to 1.9.0 are vulnerable to a cached redirect poisoning attack when a user supplies a malicious X-Forwarded-Host header.
Vulnerability Detail
A user can exploit the vulnerability by manipulating the X-Forwarded-Host header to perform cache poisoning on a cache fronting a Ratpack server. This attack is possible if the cache key does not include the X-Forwarded-Host header. The vulnerability affects users who have not configured a custom PublicAddress instance. By default, Ratpack uses an inferring version of PublicAddress, which is vulnerable. The impact of this vulnerability is that an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.
How To Fix
Latest published version: 2.0.0-rc-1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround is to ensure that the ServerConfigBuilder::publicAddress method correctly configures the server. This can be done by providing a custom URI for the public address. For example:
ServerConfigBuilder.serverConfig()
.publicAddress(new URI("http://example.com"))
.build();
Conclusion
The cached redirect poisoning vulnerability in io.ratpack:ratpack-core versions prior to 1.9.0 can be mitigated by upgrading to the latest version or by configuring a custom PublicAddress instance. It is recommended to upgrade to Ratpack 1.9.0 or later to ensure the security of your application. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.ratpack:ratpack-core →
FAQ
The vulnerability allows an attacker to perform redirect cache poisoning, potentially leading to users being redirected to malicious websites instead of the intended destination.
Users of io.ratpack:ratpack-core versions prior to 1.9.0 are affected if they have not configured a custom PublicAddress instance.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, a workaround is to configure the ServerConfigBuilder::publicAddress method with a custom URI that correctly configures the server's public address.
Yes, this vulnerability has been assigned the CVE identifier CVE-2021-29479.
Related vulnerabilities
Recent vulnerabilities recorded for io.ratpack:ratpack-core.
