CWE-444: HTTP Request Smuggling
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
Also known as Inconsistent Interpretation of HTTP Requests, HTTP Response Smuggling, HTTP Smuggling.
A kind of CWE-436 Interpretation Conflict.
From the CWE List. © The MITRE Corporation.
Newest
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling4.8 Medium
- red hat amq broker 7, amq clients, build of apache camel 4 for quarkus 3 +14 more +16 moreIo.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling6.5 Medium
- red hat amq broker 7, build of apache camel 3.33.3.sp2, build of apache camel 4 for quarkus 3 +16 more +18 moreIo.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority8.2 High
- cloudways breeze cacheBreeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters6.5 Medium
- sanic-org sanicsanic chunked trailer request smuggling allows hidden second request execution6.5 Medium
- mozilla thunderbirdAmbiguous parsing of mail headers9.8 Critical
- http4sHttp4s: Ember Server accepts duplicate Content-Length headers8.7 High
- http4sHttp4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)8.7 High
- http4sHttp4s: Ember chunk parser lenience (TE.TE request smuggling)5.4 Medium
- http4sHttp4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)9.2 Critical
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling6.5 Medium
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling6.5 Medium
- nettyNetty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding6.9 Medium
- traefikTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging8.8 High
- traefikTraefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization7.0 High
pumaDebian,ansible-coreRed Hat,ansible-testRed Hat +38 more +40 moreAn issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the...9.1 Critical- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability8.2 High
- nodejs undiciundici vulnerable to downstream response splitting via retry interceptor3.7 Low
- pydantic httpx2HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated5.6 Medium
- honojs honoHono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials5.9 Medium
- elastic elasticsearchInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure5.9 Medium
- erlang otpinets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length8.3 High
- erlang otpinets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i8.3 High
- erlang otpinets,httpd:HTTP Request Smuggling via obs-fold Header Continuation8.3 High
- envoyproxy envoyEnvoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool7.5 High
- No product listedAn issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an...6.5 Medium
- apache apisixApache APISIX: Cross-user response poisoning in serverless plugins7.0 High
- eclipse foundation jettyA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty...8.3 High
- No product listedReverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line5.3 Medium
- automattic mongooseMongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE9.1 Critical
- automattic mongooseMongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling9.1 Critical
- ether etherpadEtherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (open-redirect)6.1 Medium
- nodejs nodeA flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding...3.7 Low
- apple servicetalkServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.7.5 High
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +5 more +7 more.NET Security Feature Bypass Vulnerability5.9 Medium
- red hat build of apache camel - hawtio 4, build of apache camel for spring boot 4, data grid 8 +11 more +13 moreUndertow-core: undertow:http request smuggling via oversized chunk-size bit overlap5.3 Medium
- corebunch instaticInstatic - Cache Poisoning via Unauthenticated Server Island Endpoint6.1 Medium
- python-hyper h2h2: Duplicate Host header could facilitate request smuggling5.3 Medium
- traefikTraefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool7.0 High
- progress marklogic serverHTTP request smuggling in Progress MarkLogic Server9.1 Critical
- webpros cpanel, wp squared +1 moreHTTP Smuggling in cPanel allows potential leak of credentials.5.6 Medium
- nodejs nodeA flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding...3.7 Low
- nodejs undiciundici vulnerable to downstream response desynchronization via retry interceptor4.8 Medium
- apache traffic serverApache Traffic Server: Header-name length truncation enables header aliasing and request smuggling9.2 Critical
- apache traffic serverApache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely6.3 Medium
- apache traffic serverApache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling7.8 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smuggling7.0 High
- apache traffic serverApache Traffic Server: Request smuggling via chunked extension quoted-string parsing6.9 Medium
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities8.7 High
- ibm websphere application server, websphere application server - liberty +1 moreIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities8.7 High
- Show moreLoading…