On this page

Atomicorp WAF Rule 340365

Rule Summary

  • Rule ID: 340365
  • Status: Active
  • Alert message: Atomicorp.com WAF Rules: Host header is a list (host header poisoning)
  • Observed CWEs: None documented
  • Revision: 1
  • Rule severity: Critical (2)
  • Phase: 1 (request headers)
  • Request surfaces: Request headers
  • Rule action: deny
  • HTTP status: 400
  • Public tags: CVE-2026-71554
  • Logging: log, auditlog

Description

This rule detects behavior identified by its current alert as “Host header is a list (host header poisoning)” in the request headers. It evaluates during the request headers phase and denies matching traffic with HTTP status 400.

CVEs Referenced by This Rule

The current ModSecurity rule metadata explicitly names the following CVEs. These references explain the rule author’s association; they do not claim that the rule is limited to these vulnerabilities or that this is an exhaustive coverage list.

CVE-2026-71554

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the resulting request carries two Host header lines, providing a request smuggling primitive. This issue is fixed in version 4.4.1.

This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.

No selected related public CVE research notes are currently published.