CVE-2025-64484: 
MinimOS vulnerability analysis and mitigation

A header-smuggling vulnerability (CVE-2025-64484) was discovered in OAuth2-Proxy's handling of HTTP headers containing underscores (_). The vulnerability affects versions up to and including 7.12.0 and was patched in version 7.13.0. The issue allows authenticated users to bypass header filtering logic by using underscore variants of X-Forwarded-* headers, potentially leading to privilege escalation in upstream applications (GitHub Advisory).

The vulnerability stems from HTTP header normalization behavior where headers containing underscores are treated equivalently to their hyphenated variants. For example, both X-Forwarded-For and X_Forwarded_for would be normalized to the same header. This normalization occurs due to legacy CGI specifications where HTTP headers are converted to environment variables. The vulnerability specifically affects deployments where OAuth2-Proxy is placed in front of applications that normalize underscores to dashes in HTTP headers, such as WSGI-based frameworks (Django, Flask, FastAPI) and PHP applications (Telekom Security).

The vulnerability allows authenticated users to bypass header filtering mechanisms by injecting underscore variants of headers that would normally be stripped. This can lead to privilege escalation in upstream applications that rely on these headers for security decisions. While OAuth2-Proxy's own authentication and authorization mechanisms remain uncompromised, the header smuggling can affect security controls in the protected applications (GitHub Advisory).

The issue has been patched in OAuth2-Proxy version 7.13.0, which introduces header normalization by default. The patch ensures that both capitalization and underscore/dash usage are normalized when matching headers to be stripped. For cases requiring preservation of similar headers, a new configuration field 'InsecureSkipHeaderNormalization' has been introduced. Additionally, organizations should ensure their upstream services don't treat underscores and hyphens in headers equivalently (GitHub Advisory).