CVE-2025-36227: 
IBM Aspera Faspex vulnerability analysis and mitigation

CVE-2025-36227 is an HTTP header injection vulnerability in IBM Aspera Faspex 5, caused by improper validation of input in the HOST header. It affects versions 5.0.0 through 5.0.14.3 and was disclosed on March 10, 2026. The vulnerability could allow attackers to conduct cross-site scripting (XSS), cache poisoning, or session hijacking attacks. It carries a CVSS v3.1 base score of 5.4 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-644 (Improper Neutralization of HTTP Headers for Scripting Syntax), stemming from insufficient sanitization of user-supplied input in the HTTP HOST header. An authenticated attacker with low privileges can inject malicious content into HTTP headers, which may be reflected in server responses or cached by intermediary systems. Exploitation requires user interaction (e.g., a victim visiting a crafted URL or page), and the vulnerability has a changed scope, meaning its impact can extend beyond the vulnerable component itself (IBM Advisory).

Successful exploitation could allow an authenticated attacker to perform cross-site scripting attacks against other users, poison web caches to serve malicious content, or hijack user sessions — compromising both confidentiality and integrity of the application. Availability is not directly impacted. The changed scope indicates that the attack can affect users or systems beyond the directly vulnerable Aspera Faspex instance (IBM Advisory, Red Hat CVE).

1. Authentication: Obtain a low-privileged authenticated account on the target IBM Aspera Faspex 5 instance (versions 5.0.0–5.0.14.3).
2. Craft malicious request: Construct an HTTP request targeting the Faspex application with a manipulated Host header containing injected content (e.g., a malicious script tag or redirect URL).
3. Trigger victim interaction: Deliver a crafted link or page to a target user that causes their browser to send the manipulated request to the Faspex server.
4. Exploit reflected content: If the server reflects the injected HOST header value in its response (e.g., in a redirect or link), the victim's browser may execute the injected script (XSS) or be redirected to an attacker-controlled resource.
5. Session hijacking or cache poisoning: Leverage the injected header to steal session cookies via XSS, or poison a shared cache so that subsequent legitimate users receive the malicious response (IBM Advisory).

• Network: HTTP requests to the Aspera Faspex 5 application containing anomalous or unexpected Host header values (e.g., headers with script tags, encoded characters, or external domain references).
• Logs: Web server or application access logs showing requests with unusual Host header values that differ from the configured server hostname; repeated requests from the same authenticated user with varying Host headers.
• Application: Unexpected redirects or responses containing injected content served to users; cache entries containing script tags or external resource references not originating from the application.

IBM has released version 5.0.15 of Aspera Faspex 5 to address this vulnerability; organizations should upgrade immediately from any version in the 5.0.0–5.0.14.3 range. As interim mitigations, administrators should implement strict input validation and sanitization for HTTP headers, apply HTTP security headers such as Content-Security-Policy to reduce XSS impact, and restrict access to the Faspex application to authorized users only. Monitoring and logging of HTTP header injection attempts is also recommended (IBM Advisory).