{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T07:03:04Z","timestamp":1782975784478,"version":"3.54.5"},"reference-count":56,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["CNS-21-54404,CNS-20-46361"],"award-info":[{"award-number":["CNS-21-54404,CNS-20-46361"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00166","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"4730-4748","source":"Crossref","is-referenced-by-count":0,"title":["Poisoned by the Host: Large-Scale Measurement of Host Name Poisoning in Web Applications"],"prefix":"10.1109","author":[{"given":"Rui","family":"Yang","sequence":"first","affiliation":[{"name":"Johns Hopkins University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Johns Hopkins University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhicheng","family":"Sun","sequence":"additional","affiliation":[{"name":"Johns Hopkins University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhengyu","family":"Liu","sequence":"additional","affiliation":[{"name":"Johns Hopkins University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yinzhi","family":"Cao","sequence":"additional","affiliation":[{"name":"Johns Hopkins University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC9112"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.17487\/RFC9113"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.17487\/RFC9114"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-80825-9_1"},{"key":"ref5","doi-asserted-by":"crossref","DOI":"10.1145\/2976749.2978394","article-title":"Host of troubles: Multiple host ambiguities in http implementations","volume-title":"Proc. ACM Conf. on Computer and Communications Security (CCS)","author":"Chen","year":"2016"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.17487\/rfc7239"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645510"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.240523"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627140"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/DSN53405.2022.00014"},{"key":"ref11","article-title":"Argus: A framework for staged static taint analysis of github workflows and actions","volume-title":"Proc. USENIX Security Symposium","author":"Muralee"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2012.6224294"},{"key":"ref14","article-title":"Usage statistics and market share of nginx","volume-title":"2025, statistics page for Nginx usage","year":"2025"},{"key":"ref15","article-title":"Usage statistics and market share of apache","volume-title":"statistics page for Apache usage","year":"2025"},{"key":"ref16","article-title":"October 2025 web server survey","volume-title":"2025, monthly web server market share report","year":"2025"},{"key":"ref17","article-title":"Usage statistics of server-side programming languages for websites","volume-title":"server-side language distribution","year":"2025"},{"key":"ref18","article-title":"deps.dev: Api and public dataset","volume-title":"2025, database and official documentation","year":"2025"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.14722\/madweb.2024.23004"},{"key":"ref20","article-title":"Q1: Objectoriented queries on relational data","author":"Avgustinov","year":"2016","journal-title":"Proc. European Conf. on Object-Oriented Programming (ECOOP)"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/3661167.3661262"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23009"},{"key":"ref23","article-title":"Allowed_hosts - django settings reference","volume-title":"2025, official documentation","year":"2025"},{"key":"ref24","article-title":"Allowedhostsfilter - play framework 3.0 documentation","volume-title":"2025, official documentation","year":"2025"},{"key":"ref25","article-title":"Sanic documentation: Core api","volume-title":"2025, official documentation","year":"2025"},{"key":"ref26","article-title":"Tornado documentation: httputil module","volume-title":"2025, official documentation","year":"2025"},{"key":"ref27","article-title":"Gin documentation: Deployment guide","volume-title":"2025, official documentation","year":"2025"},{"key":"ref28","article-title":"Asp.net core documentation: Proxy and load balancer scenarios","volume-title":"2025, official documentation","year":"2025"},{"key":"ref29","article-title":"Fastify documentation: Server reference trustproxy option","volume-title":"2025, official documentation","year":"2025"},{"key":"ref30","article-title":"Django documentation: Use_x_forwarded_host setting","volume-title":"2025, official documentation","year":"2025"},{"key":"ref31","article-title":"Tornado documentation: httpserver module","volume-title":"2025, official documentation","year":"2025"},{"key":"ref32","article-title":"Koa documentation: Application settings","volume-title":"2025, official documentation","year":"2025"},{"key":"ref33","article-title":"Spring documentation: Forwardedheaderfilter","volume-title":"2025, official documentation","year":"2025"},{"key":"ref34","article-title":"Flask documentation: Host header validation","volume-title":"2025, official documentation","year":"2025"},{"key":"ref35","article-title":"Fastapi documentation: Trustedhostmiddleware","volume-title":"2025, official documentation","year":"2025"},{"key":"ref36","article-title":"Gin documentation: Deployment configuration options","volume-title":"2025, official documentation","year":"2025"},{"key":"ref37","article-title":"Actix web documentation: Connectioninfo","volume-title":"2025, official documentation","year":"2025"},{"key":"ref38","article-title":"Starlette documentation: Other middleware","volume-title":"2025, official documentation","year":"2025"},{"key":"ref39","article-title":"aiohttp documentation: Forwarded header support","volume-title":"2025, official documentation","year":"2025"},{"key":"ref40","article-title":"Asp.net core documentation: Host filtering and allowedhosts","volume-title":"2025, official documentation","year":"2025"},{"key":"ref41","article-title":"Rails security guide: Dns rebinding and host header attacks","volume-title":"2025, official documentation","year":"2025"},{"key":"ref42","article-title":"Flask documentation: Web security guide","volume-title":"2025, official documentation","year":"2025"},{"key":"ref43","article-title":"Django security topics: Host header validation","volume-title":"2025, official documentation","year":"2025"},{"key":"ref44","article-title":"Hapi documentation: request.url","volume-title":"2025, official documentation","year":"2025"},{"key":"ref45","article-title":"Flask api reference: Request.url","volume-title":"2025, official documentation","year":"2025"},{"key":"ref46","article-title":"Fastapi documentation: Using request directly","volume-title":"2025, official documentation","year":"2025"},{"key":"ref47","article-title":"Play framework documentation: Allowedhostsfilter","volume-title":"2025, official documentation","year":"2025"},{"key":"ref48","article-title":"Asp.net core documentation: Host filtering and allowedhosts","volume-title":"2025, official documentation","year":"2025"},{"key":"ref49","article-title":"Flask api reference: url_for","volume-title":"2025, official documentation","year":"2025"},{"key":"ref50","article-title":"Flask api reference: Request.host","volume-title":"2025, official documentation","year":"2025"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/2736277.2741089"},{"key":"ref52","article-title":"End-users get maneuvered: Empirical analysis of redirection hijacking in cdns","author":"Hao","year":"2018","journal-title":"USENIX Security"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.242247"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2019.10.027"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1016\/j.scico.2014.12.004"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.52167\/1609-1817-2021-116-1-275-281"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573413.pdf?arnumber=11573413","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:33:56Z","timestamp":1782970436000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573413\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":56,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00166","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}