Host Header Injection
High · Injection
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-644
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-644
Definition
App trusts Host header for links/password reset.
Root cause
Using Host in URL generation without validation.
Affected components
- Components in the “Injection” class
- Application / API handlers
- Supporting libraries
Impact
Password reset poisoning, SSRF, cache poison.
Severity
High · CVSS 7.5
Safe lab reproduction
Host header labs
Detection methodology
Send alternate Host headers in lab.
Evidence examples
- Lab reproduction notes: Host header labs
- Request/response excerpts (redacted)
- Detection signal: Send alternate Host headers in lab
Remediation
Allow-list Host; use configured canonical host.
Secure coding examples
Generate URLs from config, not raw Host.
Related CYNARKS lessons & labs
Tools: burp
Practise related skills in Labs or deepen on Academy library.