CWE-444: HTTP Request Smuggling
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Also known as Inconsistent Interpretation of HTTP Requests, HTTP Response Smuggling, HTTP Smuggling.
A kind of CWE-436 Interpretation Conflict.
From the CWE List. © The MITRE Corporation.
Newest
- jetbrains ktor In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine 4.8 Medium
- apache software foundation sling engine Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling No score
- openwrt uhttpd uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching 6.9 Medium
- openwrt uhttpd uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset 3.7 Low
- openwrt uhttpd uhttpd: HTTP request smuggling via ubus POST body parse-error desync 6.9 Medium
-
starletDebian Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection 9.1 Critical - red hat build of apache camel for spring boot 4, enterprise linux 8, enterprise linux 9 +5 more +7 more Undertow: undertow: chunkreader message length permits chunk-size overflow 6.5 Medium
- caddyserver caddy Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through 2.9 Low
- python software foundation cpython Lenient parsing of integers for response body and chunk framing 2.0 Low
- mtrudel bandit Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit 6.3 Medium
-
starmanDebian,perl-StarmanopenSUSE +1 more Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections 9.1 Critical - labstack echo Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls 9.1 Critical
- twisted Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value 5.4 Medium
- gitlab Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab 7.5 High
- apache software foundation traffic server Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling 6.9 Medium
- apache software foundation traffic server Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out 9.2 Critical
- apache software foundation traffic server Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request 7.0 High
- apache software foundation traffic server Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling 9.1 Critical
- apache software foundation brpc Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing 7.5 High
- eclipse foundation threadx - netx duo NetX Duo Web HTTP server interprets request body content as HTTP header fields 6.9 Medium
- cloudflare https://github.com/cloudflare/pingora Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments 8.7 High
- cloudflare https://github.com/cloudflare/pingora Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass 6.3 Medium
- aio-libs aiohttp AIOHTTP: Pure-Python parser request smuggling 6.3 Medium
- bytecodealliance wasmtime Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 wasi-http Request Smuggling 6.3 Medium
- bytecodealliance wasmtime Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 HTTP Response Splitting via wasi-http 6.9 Medium
- pupnp pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling 7.1 High
- eclipse vert.x In Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well known HTTP headers, the canonicalization process interprets w… 8.7 High
- red hat hardened images Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy 7.2 High
- squid-cache squid Squid Request Smuggling in HTTP Transfer-Encoding 7.7 High
- microsoft asp.net core, asp.net core 10.0, asp.net core 11.0 +6 more +8 more ASP.NET Core Tampering Vulnerability 9.4 Critical
- microsoft asp.net core 10.0, asp.net core 11.0, asp.net core 8.0 +3 more +5 more ASP.NET Core Security Feature Bypass Vulnerability 9.1 Critical
- go standard library net/http HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http 7.5 High
- go standard library net/http, net/http/internal/http2, golang.org/x/net golang.org/x/net/http2 +2 more HTTP/2 transport accepts malformed framing-related headers in net/http 7.5 High
- go standard library net/http, net/http/httputil +1 more HTTP/1 client connection desynchronization after CONNECT rejection in net/http 7.5 High
- progress software progress® telerik® fiddler® classic Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic 3.6 Low
- progress software progress® telerik® fiddler® classic HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic 6.3 Medium
- apache http server Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling 7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 more Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body 5.3 Medium
- elixir-mint mint Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries 6.3 Medium
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 more HTTP Request Smuggling 9.3 Critical
- netty Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec 6.9 Medium
- netty Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass 6.9 Medium
- apache software foundation tomcat Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up 9.1 Critical
- apache software foundation tomcat Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests 3.7 Low
- No product listed pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in... 6.5 Medium
- elixir-mint mint Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections 6.3 Medium
- red hat amq broker 7, amq clients, build of apache camel 4 for quarkus 3 +14 more +16 more Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing 6.5 Medium
- ibm websphere application server, websphere application server - liberty +1 more IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling 4.8 Medium
- ibm websphere application server IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability 6.5 Medium
- ibm websphere application server, websphere application server - liberty +1 more IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling 4.8 Medium
- Show olderLoading…