diff --git a/framework/src/main/java/org/apache/felix/framework/ResolverStateImpl.java b/framework/src/main/java/org/apache/felix/framework/ResolverStateImpl.java
index a81d33d..f9937b0 100644
--- a/framework/src/main/java/org/apache/felix/framework/ResolverStateImpl.java
+++ b/framework/src/main/java/org/apache/felix/framework/ResolverStateImpl.java
@@ -205,8 +205,21 @@
                     {
                         continue;
                     }
+                    else if (req.getNamespace().equals(Capability.HOST_NAMESPACE) &&
+                        (!((BundleProtectionDomain) req.getModule().getSecurityContext())
+                            .impliesDirect(new BundlePermission(
+                                req.getModule().getSymbolicName(),
+                                BundlePermission.FRAGMENT))
+                        || !((BundleProtectionDomain) cap.getModule().getSecurityContext())
+                            .impliesDirect(new BundlePermission(
+                                cap.getModule().getSymbolicName(),
+                                BundlePermission.HOST))))
+                    {
+                        continue;
+                    }
                 }
-                else if (req.getNamespace().equals(Capability.HOST_NAMESPACE)
+
+                if (req.getNamespace().equals(Capability.HOST_NAMESPACE)
                     && cap.getModule().isResolved())
                 {
                     continue;