CVE-2024-32980

Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to arbitrary hosts via the `Host` HTTP header. The following conditions need to be met for an application to be vulnerable: 1. The environment Spin is deployed in routes requests to the Spin runtime based on the request URL instead of the `Host` header, and leaves the `Host` header set to its original value; 2. The Spin application's component handling the incoming request is configured with an `allow_outbound_hosts` list containing `"self"`; and 3. In reaction to an incoming request, the component makes an outbound request whose URL doesn't include the hostname/port. Spin 2.4.3 has been released to fix this issue.

• CWE-610

• https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354
• https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh
• https://github.com/fermyon/spin/commit/b3db535c9edb72278d4db3a201f0ed214e561354
• https://github.com/fermyon/spin/security/advisories/GHSA-f3h7-gpjj-wcvh

Published

May 8, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32975Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32976Envoy is a cloud-native, open source edge and service proxy.…7.5
• CVE-2024-32977OctoPrint provides a web interface for controlling consumer …9.4
• CVE-2024-32978Kaminari is a paginator for web app frameworks and object re…6.6
• CVE-2024-32979Nautobot is a Network Source of Truth and Network Automation…6.1
• CVE-2024-3298Out-Of-Bounds Write and Type Confusion vulnerabilities exist…7.8
• CVE-2024-32981Silverstripe framework is the PHP framework forming the base…5.4
• CVE-2024-32982Litestar and Starlite is an Asynchronous Server Gateway Inte…8.2
• CVE-2024-32983Misskey is an open source, decentralized microblogging platf…7.5
• CVE-2024-32984Yamux is a stream multiplexer over reliable, ordered connect…7.5
• CVE-2024-32985Stellar-core is a reference implementation for the peer-to-p…5.9
• CVE-2024-32986PWAsForFirefox is a tool to install, manage and use Progress…9.6