CWE-444: HTTP Request Smuggling
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Also known as Inconsistent Interpretation of HTTP Requests, HTTP Response Smuggling, HTTP Smuggling.
A kind of CWE-436 Interpretation Conflict.
From the CWE List. © The MITRE Corporation.
Newest
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests7.4 High
- tomaka rouilleRouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection6.9 Medium
- tomaka rouilleRouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header6.3 Medium
- tiny-httptiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling6.3 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 6 +4 more +6 moreLibsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()5.4 Medium
- http4s blazeblaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)7.4 High
- http4s blaze, org.http4s blaze-http 2.13, blaze-http 3 +1 more +3 moreblaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser7.4 High
- libeventLibevent: HTTP header handling bugs create risk of access control bypass.9.2 Critical
- libeventlibevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling9.2 Critical
- libeventLibevent: HTTP Header smuggling6.3 Medium
- apple swift-nio-http2, swiftnio http\/2 +1 moreswift-nio-http2: Missing CR/LF/NUL validation in header values5.3 Medium
- zalando skipperSkipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream8.2 High
- elixir-mint mintSign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections6.3 Medium
- eclipse grizzly, eclipse foundation glassfish +1 moreEclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed...6.3 Medium
- sap approuterHTTP Request Smuggling in SAP Approuter9.1 Critical
- zalando skipperSkipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding: chunked / HTTP/2 requests7.8 High
- openvpn access serverOpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header...6.9 Medium
- ibm cics transaction gateway for multiplatforms, websphere application server +1 moreInconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.7.4 High
- ibm websphere application server - liberty, websphere application server +1 moreIBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability7.2 High
- amazon application load balancerHTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF7.9 High
- amazon cloudfront, aws amazon cloudfront +1 moreHTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF7.9 High
- nghttp2nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length6.3 Medium
- envoyproxy envoyEnvoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length7.5 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities7.4 High
- http4khttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy6.3 Medium
- php-standard-library, php-standard-library php-standard-library/h2 +1 morePHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling7.5 High
- tinyproxyTinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers9.3 Critical
- tinyproxyTinyproxy - HTTP Request Smuggling via CL/TE Desynchronization9.3 Critical
- caddyserver caddy, red hat hardened images +1 moreCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`8.1 High
- vllm, red hat exploit intelligence, openshift lightspeed +12 more +14 morevLLM: OpenAI auth bypass9.1 Critical
- fastapiexpert python-multipartPython-Multipart: Semicolon treated as querystring field separator enables parameter smuggling3.7 Low
- apple swift-nio-http2, swiftnio http\/2 +1 moreSwiftNIO HTTP/2: HTTP/2-to-HTTP/1 Request Smuggling via unvalidated :path pseudo-header in HTTP2ToHTTP1Codec5.3 Medium
- kong enterprise gatewayHTTP request smuggling in Kong Enteprise Gateway4.9 Medium
- spring framework, vmware spring framework +1 moreSpring Framework Multipart Request Smuggling in Spring MVC and WebFlux5.3 Medium
- djangoproject daphneHeader injection via WebSocket upgrade parser differential allows ASGI scope header spoofing3.7 Low
- the vinyl cache project vinyl cache, varnish cache (pre split), varnish software cache by varnish software +2 moreIn Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request...2.3 Low
- elixir-mint mintHTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing6.3 Medium
- yhirose cpp-httplibcpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection9.9 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: libsoup: http request smuggling via unsigned to signed conversion error4.8 Medium
- honoHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths5.3 Medium
- ibm http serverIBM HTTP Server is affected by multiple vulnerabilities9.8 Critical
- ibm web server plug-ins for websphere application server and websphere liberty, websphere application server +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins7.5 High
- encode starlette, red hat exploit intelligence, openshift lightspeed +18 more +20 moreStarlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks6.5 Medium
- @clerk nuxt, nuxt nuxt\/nitro-server +1 moreNuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning2.3 Low
- kazeburo gazelleGazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence7.5 High
- kazuho starletStarlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence5.3 Medium
- mtrudel banditCL.CL HTTP request smuggling via duplicate Content-Length in bandit6.3 Medium
- miyagawa starmanStarman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence7.5 High
- apache pony mailPony Mail: Admin account takeover via request smuggling9.8 Critical
- actix actix-httpactix-http before 3.12.1 HTTP Request Smuggling via CL.TE6.3 Medium
- Show moreLoading…