Skip to content
Fencer Vulns
medium 4.8

CVE-2021-41114 json

HTTP Host Header Injection in Request Handling in Typo3

published 2021-10-05 5 y ago modified 2026-07-08 4 mo ago also BIT-typo3-2021-41114 , EUVD-2021-2219 , GHSA-m2jh-fxw4-gphm

cvss
4.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

Patch / fix

  • packagist typo3/cms-core 11.5.0
  • packagist typo3/cms 11.5.0
  • bitnami typo3 11.5.0
  • typo3 typo3 11.5.0

Exploit prediction

1.22% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N
OSV 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
packagist typo3/cms-core
>=11.0.0, <11.5.0
11.5.0
packagist typo3/cms
>=11.0.0, <11.5.0
11.5.0
bitnami typo3
>=11.0.0, <11.5.0
11.5.0

Affected products

  • TYPO3 typo3

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.