{"action":"Upgrade october/backend to 1.1.2 or later.","affected":[{"fixed":"1.1.2","introduced":"0"}],"component":"october/backend","cve_ids":["CVE-2021-21265"],"ecosystem":"Packagist","epss":0.01748,"exploited":false,"fixed_versions":["1.1.2"],"ghsa_id":"GHSA-xhfx-hgmf-v6vp","id":"tcs_01M5KFB2SWGV77DRPEXBHS4KZ4","modified_at":"2026-07-08T06:28:47.054571329Z","published_at":"2021-03-10T21:07:25Z","references":["https://osv.dev/vulnerability/GHSA-xhfx-hgmf-v6vp","https://github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp","https://nvd.nist.gov/vuln/detail/CVE-2021-21265","https://github.com/octobercms/library/commit/f29865ae3db7a03be7c49294cd93980ec457f10d","https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6","https://github.com/octobercms/october/commit/555ab61f2313f45d7d5d138656420ead536c5d30","https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0","https://packagist.org/packages/october/backend"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-xhfx-hgmf-v6vp","url":"https://osv.dev/vulnerability/GHSA-xhfx-hgmf-v6vp"}],"summary":"October CMS vulnerable to Potential Host Header Poisoning on misconfigured servers"}