CVE-2026-62987

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>fabio</name>
	<range><lt>1.7.2</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Fabio is an HTTP(S) and TCP router for deploying applications managed
	by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in
	proxy/http_headers.go uses protectHeaders for a hardcoded set of
	forwarded headers but omits the operator-configured ClientIPHeader,
	TLSHeader, and RequestID names. In proxy/http_proxy.go,
	HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before
	Go ReverseProxy processes the inbound Connection header, allowing an
	unauthenticated client to name and remove the configured headers
	before the request reaches the backend. Deployments that enable the
	corresponding proxy.header options can therefore lose client-IP,
	TLS-termination, or request-correlation signals used by backend
	authorization and auditing; the options are empty by default, and the
	hardcoded protected forwarded headers are unaffected. This issue is
	fixed in version 1.7.2.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-62987</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-62987</url>
    </references>
    <dates>
      <discovery>2026-09-21</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>