Hop-by-hop abuse to malform header mutator in github.com/ory/oathkeeper
Summary
GHSA-w9mr-28mw-j8hg: Hop-by-hop abuse to malform header mutator. Affects github.com/ory/oathkeeper versions < 0.40.3. Fixed in 0.40.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/ory/oathkeeper is an open-source project written in Go that provides an API gateway and access control solution. It allows users to define rules for authentication, authorization, and other security-related operations. The header mutator is a component of Oathkeeper that modifies HTTP headers before forwarding requests to upstream services.
Vulnerability Detail
The header mutator in github.com/ory/oathkeeper is vulnerable to hop-by-hop abuse. Downstream services relying on headers set by the header mutator can be exploited. An attacker can drop a specific header by including its name in the Connection header. This means that the X-Subject header, for example, can be completely dropped if the attacker includes x-subject in the Connection header. If the downstream server does not handle this scenario properly, it may lead to unexpected behavior or security vulnerabilities.
How To Fix
Latest published version: v0.40.9 as of 23 Oct 2026
go get github.com/ory/oathkeeper@v0.40.9Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.40.3
This is the first release that contains the fix.
go get github.com/ory/oathkeeper@v0.40.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately update to the patched version, you can implement a workaround by ensuring that the downstream server handles the case where an expected header is not set. The server should respond with an appropriate error message to mitigate the risk of unexpected behavior or security vulnerabilities.
Conclusion
The header mutator in github.com/ory/oathkeeper is vulnerable to hop-by-hop abuse, allowing an attacker to drop specific headers set by the mutator. To mitigate this vulnerability, it is recommended to update to version 0.40.3 or later. If immediate update is not possible, implement a workaround by ensuring the downstream server handles the absence of expected headers properly. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/ory/oathkeeper →
FAQ
The impact of this vulnerability is that an attacker can drop specific headers set by the header mutator, potentially leading to unexpected behavior or security vulnerabilities in downstream services.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Gopkg.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, if you are unable to immediately update to the patched version, you can implement a workaround by ensuring that the downstream server handles the case where an expected header is not set. The server should respond with an appropriate error message to mitigate the risk of unexpected behavior or security vulnerabilities.
There are no known exploits of this vulnerability at the moment. However, it is important to update to the patched version or implement the workaround to prevent potential exploitation.
You can find more information about this vulnerability in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-w9mr-28mw-j8hg/GHSA-w9mr-28mw-j8hg.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/ory/oathkeeper.
