CVE-2018-1193: Cloudfoundry Cf-Deployment

Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially bypass an application requirement to only respond over secure connections.

Affected products

• Cloudfoundry Cf-Deployment: before 1.27.0 (fixed in 1.27.0)
• Cloudfoundry Routing-Release: before 0.175.0 (fixed in 0.175.0)

Published 2018-05-23. Last modified 2026-06-17.