CVE-2009-2058: Apple Safari before 3.2.2 uses the HTTP Host header to determine the context of a document provided in a (1...

Security readout for executives and security teams

This is an old Safari issue where a hostile network position could make Safari treat a proxy error page as if it came from the intended HTTPS site. That could let attacker-supplied script run in the wrong website context. The source names Safari before 3.2.2, but provides no CVSS score or current exploitation evidence. Likely limited to legacy systems running Safari before 3.2.2, especially old Macs, lab images, kiosks, or archived virtual machines using proxy infrastructure. Normal modern browser fleets are unlikely to be exposed unless unsupported legacy Safari remains in use. Handle as a legacy exposure cleanup item unless vulnerable Safari is found on business-critical systems. If present, prioritize removal because the flaw affects browser trust boundaries during proxied HTTPS access. Mitigation focus: Inventory endpoints for Safari versions before 3.2.2.; Upgrade or retire legacy Safari installations following Apple/vendor guidance.; Reduce use of untrusted or unmanaged proxy paths for legacy clients..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.