Detections
Analytics

SCA: security update for github.com/fabiolb/fabio (GHSA-q7p4-7xjv-j3wf)

critical Tenable Cloud Security Plugin ID 434407

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6,
 Fabio allows clients to remove X-Forwarded headers (except X-Forwarded-For) due to a vulnerability in how
 it processes hop-by-hop headers. Fabio adds HTTP headers like X-Forwarded-Host and X-Forwarded-Port when
 routing requests to backend applications. Since the receiving application should trust these headers,
 allowing HTTP clients to remove or modify them creates potential security vulnerabilities. Some of these
 custom headers can be removed and, in certain cases, manipulated. The attack relies on the behavior that
 headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been patched in
 version 1.6.6. (CVE-2025-48865)

See Also

https://github.com/advisories/GHSA-q7p4-7xjv-j3wf

Plugin Details

Severity: Critical

ID: 434407

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.81

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N

CVSS Score Source: CVE-2025-48865

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 5/29/2025

Vulnerability Publication Date: 5/29/2025

Reference Information

CVE: CVE-2025-48865