{"id":"CVE-2026-77803","aliases":["EUVD-2026-92426","GHSA-xq67-hr2w-mm32"],"status":"published","title":"Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic","description":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.","severity":{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00097,"percentile":0.00722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-444"],"published":"2026-10-05T12:39:36Z","modified":"2026-10-06T18:16:56Z","products":[{"vendor":"progress software","product":"progress® telerik® fiddler® classic"}],"references":[{"url":"https://docs.telerik.com/fiddler/knowledge-base/kb-security-front-end-desynchronization-cve-2026-77803","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77803"},{"url":"https://github.com/advisories/GHSA-xq67-hr2w-mm32"}],"sources":{"cve":[{"id":"CVE-2026-77803","title":"Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic","description":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.","status":"published","published":"2026-10-05T12:39:36.806Z","modified":"2026-10-06T17:50:34.935Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:20:16.072351Z"}],"euvd":[{"id":"EUVD-2026-92426","description":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.","status":"published","published":"2026-10-05T12:39:36Z","modified":"2026-10-06T17:50:34Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T17:27:36.701921Z"}],"ghsa":[{"id":"GHSA-xq67-hr2w-mm32","title":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end...","description":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.","status":"published","published":"2026-10-05T15:32:22Z","modified":"2026-10-05T15:32:23Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:12:48.068686Z"}],"nvd":[{"id":"CVE-2026-77803","description":"In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.","status":"published","published":"2026-10-05T13:16:54.453Z","modified":"2026-10-06T18:16:56.27Z","cvss":[{"version":"3.1","score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:12:53.75133Z"}]}}