CVE-2021-29479

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, a user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key. Users are only vulnerable if they do not configure a custom `PublicAddress` instance. For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable. This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location. The vulnerability was patched in Ratpack 1.9.0. As a workaround, ensure that `ServerConfigBuilder::publicAddress` correctly configures the server in production.

• CWE-807

• https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7qThird Party Advisory
• https://portswigger.net/web-security/web-cache-poisoningExploit, Third Party Advisory
• https://github.com/ratpack/ratpack/security/advisories/GHSA-w6rq-6h34-vh7qThird Party Advisory
• https://portswigger.net/web-security/web-cache-poisoningExploit, Third Party Advisory

Published

Jun 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-29473Exiv2 is a C++ library and a command-line utility to read, w…2.5
• CVE-2021-29474HedgeDoc (formerly known as CodiMD) is an open-source collab…5.8
• CVE-2021-29475HedgeDoc (formerly known as CodiMD) is an open-source collab…10
• CVE-2021-29476Requests is a HTTP library written in PHP. Requests mishandl…9.8
• CVE-2021-29477Redis is an open source (BSD licensed), in-memory data struc…8.8
• CVE-2021-29478Redis is an open source (BSD licensed), in-memory data struc…8.8
• CVE-2021-29480Ratpack is a toolkit for creating web applications. In versi…3.1
• CVE-2021-29481Ratpack is a toolkit for creating web applications. In versi…7.5
• CVE-2021-29482xz is a compression and decompression library focusing on th…7.5
• CVE-2021-29483ManageWiki is an extension to the MediaWiki project. The 'wi…7.5
• CVE-2021-29484Ghost is a Node.js CMS. An unused endpoint added during the …6.8
• CVE-2021-29485Ratpack is a toolkit for creating web applications. In versi…8.8