CWE-444: HTTP Request Smuggling
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Also known as Inconsistent Interpretation of HTTP Requests, HTTP Response Smuggling, HTTP Smuggling.
A kind of CWE-436 Interpretation Conflict.
From the CWE List. © The MITRE Corporation.
Newest
- netty, canonical ubuntu linux, debian linux +3 more +5 moreHTTP Request Smuggling in Netty9.1 Critical
- netty, apache spark, canonical ubuntu linux +4 more +6 moreHTTP Request Smuggling in Netty9.1 Critical
- syliusAbility in Sylius to switch channels via GET parameter enabled in production environments4.4 Medium
- sylius syliusresourcebundleAbility to expose data in Sylius by using an unintended serialisation group4.4 Medium
- jetbrains ktorRequest smuggling is possible in Ktor when both chunked TE and content length specified5.4 Medium
- netty, debian linux, fedoraproject fedora +3 more +5 moreHTTP Request Smuggling in Netty7.5 High
- f5 nginx, apple xcode, canonical ubuntu linux +2 more +4 moreNGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as...5.3 Medium
- agendaless waitress, debian linux, fedoraproject fedora +2 more +4 moreHTTP Request Smuggling in Waitress: Invalid whitespace characters in headers7.1 High
waitressPyPIHTTP Request Smuggling: Invalid whitespace characters in headers in WaitressNo score- agendaless waitress, debian linux, oracle communications cloud native core network function cloud native environment +2 moreHTTP Request Smuggling: Content-Length Sent Twice in Waitress7.1 High
- agendaless waitress, debian linux, fedoraproject fedora +2 more +4 moreHTTP Request Smuggling: LF vs CRLF handling in Waitress7.1 High
- agendaless waitress, debian linux, fedoraproject fedora +2 more +4 moreHTTP Request Smuggling: Invalid Transfer-Encoding in Waitress7.1 High
- squid-cache squid, canonical ubuntu linux, debian linux +1 more +3 moreAn issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP...5.3 Medium
- haproxyA flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding...7.5 High
- cisco unified communications managerCisco Unified Communications Manager Security Bypass Vulnerability6.5 Medium
- golang go, debian linux, fedoraproject fedora +6 more +8 moreGo before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling.7.5 High
- netty, canonical ubuntu linux, debian linux +1 more +3 moreHTTP Request Smuggling in Netty7.5 High
- parse parse-serverParse Server before v3.4.1 vulnerable to Denial of Service7.5 High
- apache http server, canonical ubuntu linux, fedoraproject fedora +7 more +9 moreA vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a...4.2 Medium
- getcujo smart firewallAn exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall,...5.3 Medium
- node.js, suse enterprise storage, linux enterprise server +1 more +3 moreNode.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can...7.5 High
- apache traffic server, debian linux +1 moreThere are multiple HTTP smuggling and cache poisoning issues when clients making malicious...6.5 Medium
- samsung, samsung sth-eth-250 firmware +1 moreAn exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung...9.1 Critical
- samsung, samsung sth-eth-250 firmware +1 moreAn exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung...9.1 Critical
- samsung, samsung sth-eth-250 firmware +1 moreAn exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung...9.1 Critical
- hewlett packard enterprise hpe centralview fraud risk management, hp centralview fraud risk management +1 moreHPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk...6.1 Medium
- red hat undertow, redhat jboss enterprise application platform +1 moreUndertow Request Smuggling vulnerability2.6 Low
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +17 more +19 moreJetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)9.8 Critical
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +15 more +17 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations9.8 Critical
- eclipse jetty, the eclipse foundation eclipse jetty, debian linux +2 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarations7.5 High
- apsis pound, debian linux +1 moreApsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability...9.8 Critical
- red hat undertowUndertow vulnerable to Request Smuggling6.1 Medium
- keycloak, redhat single sign on +1 moreKeycloak Reflected XSS5.4 Medium
- ikarussecurity ikarus antivirusAn active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS...7.4 High
- golang go, fedoraproject fedora, redhat enterprise linux server +3 more +5 moreThe net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP...9.8 Critical
- golang go, fedoraproject fedora, redhat enterprise linux server +3 more +5 moreThe net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP...9.8 Critical
- red hat resteasy, redhat jboss enterprise application platform +1 moreInconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP7.5 High
- [unknown] undertow, debian linux, redhat jboss enterprise application platform +2 moreUndertow-core vulnerable to HTTP Request Smuggling6.5 Medium
- aeroadminAeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can...8.1 High
- foscam c1 indoor hd camera firmware, indoor ip camera c1 series +1 moreIn the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2...8.8 High
- sun java system application server, java system web server, java system web proxy server +1 more +3 moreHTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used...6.8 Medium
- microsoft internet information servicesMicrosoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application...4.3 Medium
- apache http server, debian linux +1 moreThe Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy,...4.3 Medium