CVE-2023-34041: CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry Gorouter

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-08 · updated 2026-06-17

Description

Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers. An unauthenticated attacker can use this vulnerability for headers like B3 or X-B3-SpanID to affect the identification value recorded in the logs in foundations.

Affected products

Cloud Foundry cf-deployment: before 32.4.0 — fixed in 32.4.0
Cloudfoundry Routing-Release: before 0.278.0 — fixed in 0.278.0

How to fix

Upgrade to a fixed version: Cloud Foundry cf-deployment 32.4.0; Cloudfoundry Routing-Release 0.278.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-34041 or the next vulnerability affects your stack