On this page
Atomicorp WAF Rule 340364
Rule Summary
- Rule ID: 340364
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Multiple Host headers in one request (host header poisoning)
- Observed CWEs: CWE-20 (1), CWE-444 (4)
- Revision: 1
- Rule severity: Critical (2)
- Phase: 1 (request headers)
- Request surfaces: Request headers
- Rule action: deny
- HTTP status: 400
- Public tags: CVE-2026-71554
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Multiple Host headers in one request (host header poisoning)” in the request headers. It evaluates during the request headers phase and denies matching traffic with HTTP status 400.
CVEs Referenced by This Rule
The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.
CVE-2026-71554
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.
- Association: The rule references CVE-2026-71554 in its tag.
- CVE Record (opens in a new tab)
- NVD (opens in a new tab)
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2026-100664 | Netty codec-http3: HTTP/1 Host header authority confusion | netty-codec-http3 | 8.7 (v4.0) | High |
| CVE-2025-14523 | libsoup: duplicate Host header handling, last value wins | libsoup | 8.2 (v3.1) | High |
| CVE-2026-93569 | Netty codec-http2: absolute-form Host mismatch translated to :authority | netty-codec-http2 | 8.2 (v3.1) | High |
| CVE-2026-59900 | Netty codec-http2: Host header not deduplicated in HTTP/2 to HTTP/1.x translation | netty-codec-http2 | 6.9 (v4.0) | Medium |
| CVE-2026-71554 | h2 (Python HTTP/2): duplicate Host header forwarded, request smuggling | h2 | 5.3 (v3.1) | Medium |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.
| CWE | Related Published CVEs |
|---|---|
| CWE-20 | CVE-2026-100664 |
| CWE-444 | CVE-2025-14523 , CVE-2026-93569 , CVE-2026-59900 , CVE-2026-71554 |