{"id":"CVE-2022-21826","aliases":["EUVD-2022-26985","GHSA-w594-hmpv-qhh5"],"status":"published","title":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling,...","description":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.46016,"percentile":0.98818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-444"],"published":"2022-09-30T16:24:25Z","modified":"2026-06-17T04:27:03Z","products":[{"vendor":"ivanti","product":"connect_secure"},{"vendor":"pulsesecure","product":"pulse_connect_secure"}],"references":[{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21826"},{"url":"https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/Client-Side-Desync-Attack"},{"url":"https://github.com/advisories/GHSA-w594-hmpv-qhh5"}],"sources":{"cve":[{"id":"CVE-2022-21826","description":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.","status":"published","published":"2022-09-30T16:24:25Z","modified":"2024-08-03T02:53:36.293Z","cwes":["CWE-444"],"updated_at":"2026-11-02T14:34:29.478363Z"}],"euvd":[{"id":"EUVD-2022-26985","description":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.","status":"published","published":"2022-09-30T16:24:25Z","modified":"2024-08-03T02:53:36Z","updated_at":"2026-11-03T03:25:53.384523Z"}],"ghsa":[{"id":"GHSA-w594-hmpv-qhh5","title":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling,...","description":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.","status":"published","published":"2022-10-01T00:00:20Z","modified":"2024-03-07T05:09:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:55:38.886845Z"}],"nvd":[{"id":"CVE-2022-21826","description":"Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.","status":"published","published":"2022-09-30T17:15:12.183Z","modified":"2026-06-17T04:27:03.443Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:07:29.026521Z"}]}}