CVE Intelligence
Analysis AI-assisted

CVE-2020-37056: Crystal http-protection IP Spoofing Authentication Bypass

CVE-2020-37056 affects the Crystal shard http-protection 0.2.0, where manipulated request headers can cause the protection middleware to accept a spoofed client IP. VulnCheck reports a CVSS 3.1 base score of 9.8 (critical) and classifies the flaw as CWE-290. The record shows no KEV listing and no confirmed fixed version, so administrators should review their use of forwarded-IP headers now.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Crystal http-protection 0.2.0 is a Crystal shard whose protection middleware can be bypassed through manipulated request headers, as described in the VulnCheck advisory and the CVE record at cve.org. The weakness is classified as CWE-290, authentication bypass by spoofing.

Impact

  • The description states that attackers can bypass protection checks and gain unauthorized access.
  • The CVSS 3.1 vector reported by VulnCheck (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable flaw with low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability. The base score is 9.8.
  • The same provider also lists a CVSS 4.0 score of 6.9.

Affected products and versions

  • The described affected product is the http-protection shard, version 0.2.0.
  • The record contains no structured list of affected or fixed versions, so whether other versions are affected is unknown.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog, so no active exploitation is confirmed by the sources consulted.
  • The references include an Exploit-DB entry. Its presence is noted here, but its content was not analyzed and is not reproduced.

Remediation and mitigation

  • The record does not identify a fixed version. The absence of a listed fix does not mean no fix exists, so check the upstream repository for maintainer updates.
  • Do not rely solely on client-supplied forwarded-IP headers for access control. Trust these headers only from proxies you operate, and configure the application to ignore them otherwise.
  • Where the shard is used, review whether any access decisions depend on IP-based allow lists and add independent authentication controls.
  • If a fix is not available, consider replacing or isolating the affected protection component.

Detection guidance

  • Log and review requests that carry X-Forwarded-For, X-Client-IP or X-Real-IP headers, particularly where the same value appears across many requests or conflicts with the observed connection source.
  • Alert on access to protected endpoints from addresses that are inconsistent with the expected network path or with the authenticated user's history.

Limitations of the available information

  • The record has a source status of Deferred and contains no EPSS or SSVC data.
  • No technical root-cause analysis, vendor advisory text or verified fixed version is included in the record.
  • Affected versions beyond 0.2.0 and the full scope of impacted deployments are unknown.

Frequently asked questions

Is CVE-2020-37056 known to be actively exploited?

The record does not list it in the CISA KEV catalog, so no active exploitation is confirmed by the sources consulted. An Exploit-DB entry is referenced, but its content was not analyzed here.

What is the severity of this vulnerability?

VulnCheck reports a CVSS 3.1 base score of 9.8 (critical) and a CVSS 4.0 score of 6.9. The record does not provide a score from another provider.

Which version is affected and is a fix available?

The description names http-protection 0.2.0. The record lists no fixed version, which does not mean no fix exists, so check the upstream repository for updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.