CWE-444: HTTP Request Smuggling
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Also known as Inconsistent Interpretation of HTTP Requests, HTTP Response Smuggling, HTTP Smuggling.
A kind of CWE-436 Interpretation Conflict.
From the CWE List. © The MITRE Corporation.
Newest
- hcl software bigfix service management (sm), hcltech bigfix service management +1 moreHCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling3.7 Low
- @fastify/reply-from @fastify/http-proxy, @fastify/reply-from, fastify reply-from +3 more +5 more@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers9.0 Critical
- eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 moreHTTP Request Smuggling via Chunked Extension Quoted-String Parsing7.4 High
- axios, red hat cryostat 4, gatekeeper 3 +63 more +65 moreAxios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain4.8 Medium
- apache tomcatApache Tomcat: Request smuggling via invalid chunk extension7.5 High
- tinyproxy project tinyproxyTinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling8.7 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smuggling7.5 High
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.3 Medium
- ibm security verify access, security verify access container, verify identity access +1 more +3 moreSecurity Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access5.3 Medium
- aio-libs aiohttpAIOHTTP: Duplicate Host header accepted6.3 Medium
- yhirose cpp-httplibcpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body4.8 Medium
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via malformed http request headers8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +20 more +22 moreUndertow: undertow: request smuggling via `\r\r\r` as a header block terminator8.7 High
- redhat undertow, red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4 +21 more +23 moreUndertow: undertow: request smuggling via inconsistent header parsing8.7 High
- visualfc liteideHTTP Request Smuggling in visualfc/liteide2.9 Low
- mozilla firefox, thunderbird, red hat enterprise linux 10 +18 more +20 moreMitigation bypass in the Networking: HTTP component9.8 Critical
- erlang otp, erlang\/inets, erlang\/otp +2 moreRequest smuggling via first-wins Content-Length parsing in inets httpd7.0 High
- nodejs undiciundici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')6.5 Medium
- capnprotoCap'n Proto: Integer overflow in KJ-HTTP chunk size6.3 Medium
- capnprotoCap'n Proto has an integer overflow in KJ-HTTP6.3 Medium
- maximmasiutin tinywebTinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)9.3 Critical
- cisco secure firewall adaptive security appliance (asa) software, secure firewall threat defense (ftd) software, secure firewall threat defense +1 more +3 moreCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling Vulnerability4.3 Medium
- cloudflare pingora, https://github.com/cloudflare/pingora +1 moreHTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing9.3 Critical
- cloudflare pingora, https://github.com/cloudflare/pingora +1 moreHTTP Request Smuggling via Premature Upgrade9.3 Critical
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http request smuggling via duplicate content-length headers3.7 Low
- akamai ghostAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by...4.0 Medium
- delinea inc. cloud suite and privileged access serviceCloud Suite and Privilege Access Service– HTTP request smuggling vulnerability6.9 Medium
- fortinet fortios, siemens ruggedcom ape1808 +1 moreAn inconsistent interpretation of http requests ('http request smuggling') vulnerability in...5.2 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http request smuggling via malformed chunk headers5.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: soupserver: denial of service via http request smuggling5.3 Medium
- vercel next.jsNext.js: HTTP request smuggling in rewrites6.3 Medium
- altitude communication serverHTTP Request/Response Smuggling in Altitude Communication Server6.9 Medium
- eclipse foundation vert.x, eclipse vert.x-web +1 moreEclipse Vert.x Web static handler file access denial6.9 Medium
- h3h3 v1 has Request Smuggling (TE.TE) issue8.9 High
- aio-libs aiohttpAIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol Fields2.7 Low
- aio-libs aiohttpAIOHTTP's Unicode processing of header values could cause parsing discrepancies6.3 Medium
github.com/open-feature/flagd/coreGo,github.com/open-feature/flagd/flagdGo,github.com/open-feature/flagd/flagd-proxyGo +2 moreflagd: Multiple Go Runtime CVEs Impact Security and AvailabilityNo score- quest coexistence manager for notesHTTP Request Smuggling in Quest Coexistence Manager for Notes6.3 Medium
- phpjabbers member login scriptMember Login Script 3.3 Client-Side Request Desynchronization Vulnerability6.9 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 6 +15 more +17 moreLibsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)8.2 High
- outsystems platform serverAn issue was discovered in Outsystems Platform Server 11.18.1.37828 allows attackers to cause a...7.5 High
- akamai akamaighostAkamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing...4.8 Medium
- lighttpdHTTP Header Smuggling via Trailer Merge6.9 Medium
- honoHono - Vary Header Injection in CORS Middleware6.9 Medium
- google cloud vertex ai: open models for maas, vertex ai: partner models for maas, vertex ai: self-deployed models +2 moreHTTP Desynchronisation in Vertex AI for certain third-party models6.9 Medium
- microsoft asp.net core, asp.net core 2.3, asp.net core 8.0 +5 more +7 moreASP.NET Security Feature Bypass Vulnerability9.9 Critical
- oracle configurator, e-business suite +1 moreVulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime...7.5 High
- http4sHttp4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section6.3 Medium
- watchguard fireware osWatchGuard Firebox Authentication Portal Request Smuggling Vulnerability6.9 Medium
- avigilon access control managerA Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute...9.8 Critical
- Show moreLoading…