# HTTP request smuggling.

Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first

- [Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling](https://agentprime.io/advisories/CVE-2026-103866.md)
  `CVE-2026-103866` · CVE record: Apache Software Foundation Apache Sling Engine · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: HTTP request smuggling, CWE-436
- [uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching](https://agentprime.io/advisories/CVE-2026-55614.md)
  `CVE-2026-55614` · CVE record: openwrt uhttpd · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling
- [uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset](https://agentprime.io/advisories/CVE-2026-55612.md)
  `CVE-2026-55612` · CVE record: openwrt uhttpd · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling
- [uhttpd: HTTP request smuggling via ubus POST body parse-error desync](https://agentprime.io/advisories/CVE-2026-55613.md)
  `CVE-2026-55613` · CVE record: openwrt uhttpd · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling
- [Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection](https://agentprime.io/advisories/CVE-2026-116127.md)
  `CVE-2026-116127` · CVE record · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling
- [Undertow: undertow: chunkreader message length permits chunk-size overflow](https://agentprime.io/advisories/CVE-2026-91920.md)
  `CVE-2026-91920` · CVE record: Red Hat Red Hat build of Apache Camel for Spring Boot 4 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: HTTP request smuggling
- [Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through](https://agentprime.io/advisories/GHSA-8qx7-j2v2-x6q5.md)
  `GHSA-8qx7-j2v2-x6q5`, `CVE-2026-55458`, `GO-2026-6874` · Go `github.com/caddyserver/caddy/v2`: affected `<2.11.5`, fixed in `2.11.5` · CVSS 2.9 Low · Not analysed yet · Published 28 Oct 2026 · Tags: HTTP request smuggling
- [Lenient parsing of integers for response body and chunk framing](https://agentprime.io/advisories/CVE-2026-103995.md)
  `CVE-2026-103995` · CVE record: Python Software Foundation CPython · CVSS 2.0 Low · Not analysed yet · Published 27 Oct 2026 · Tags: HTTP request smuggling
- [Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit](https://agentprime.io/advisories/GHSA-w5wc-g2hc-g7m2.md)
  `GHSA-w5wc-g2hc-g7m2`, `CVE-2026-114216`, `EEF-CVE-2026-114216` · Hex `bandit`: affected `>=1.12.4, <1.14.0`, fixed in `1.14.0` · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: HTTP request smuggling
- [Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections](https://agentprime.io/advisories/CVE-2026-115823.md)
  `CVE-2026-115823` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: HTTP request smuggling
- [Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls](https://agentprime.io/advisories/GHSA-cxf3-9h37-7rr8.md)
  `GHSA-cxf3-9h37-7rr8`, `CVE-2026-118264`, `GO-2026-6839` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: HTTP request smuggling, Broken access control
- [Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value](https://agentprime.io/advisories/GHSA-q7qq-6mhp-9rc4.md)
  `GHSA-q7qq-6mhp-9rc4`, `CVE-2026-115877` · PyPI `twisted`: affected `<26.10.0rc1`, fixed in `26.10.0rc1` · CVSS 5.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab](https://agentprime.io/advisories/CVE-2026-112212.md)
  `CVE-2026-112212` · CVE record: GitLab GitLab · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling](https://agentprime.io/advisories/CVE-2026-111809.md)
  `CVE-2026-111809` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out](https://agentprime.io/advisories/CVE-2026-111816.md)
  `CVE-2026-111816` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request](https://agentprime.io/advisories/CVE-2025-55702.md)
  `CVE-2025-55702` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling](https://agentprime.io/advisories/CVE-2025-31699.md)
  `CVE-2025-31699` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing](https://agentprime.io/advisories/CVE-2026-86146.md)
  `CVE-2026-86146` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: HTTP request smuggling
- [AIOHTTP: Pure-Python parser request smuggling](https://agentprime.io/advisories/GHSA-pqxq-w44r-73xw.md)
  `GHSA-pqxq-w44r-73xw`, `CVE-2026-111750` · PyPI `aiohttp`: affected `<3.14.4`, fixed in `3.14.4` · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: HTTP request smuggling
- [NetX Duo Web HTTP server interprets request body content as HTTP header fields](https://agentprime.io/advisories/CVE-2026-93003.md)
  `CVE-2026-93003` · CVE record: Eclipse Foundation Eclipse ThreadX - NetX Duo · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: HTTP request smuggling
- [Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments](https://agentprime.io/advisories/GHSA-vx4q-2c55-cvmg.md)
  `GHSA-vx4q-2c55-cvmg`, `CVE-2026-105299`, `RUSTSEC-2026-0390` · crates.io `pingora-proxy`: affected `>=0.0.0-0, <0.9.0`, fixed in `0.9.0` · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: HTTP request smuggling
- [Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass](https://agentprime.io/advisories/GHSA-mgg9-6xw2-jfgp.md)
  `GHSA-mgg9-6xw2-jfgp`, `CVE-2026-105298`, `RUSTSEC-2026-0388` · crates.io `pingora-core`: affected `>=0.0.0-0, <0.9.0`, fixed in `0.9.0` · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: HTTP request smuggling
- [\`wasi-http\`: Guests can add conflicting content lengths to messages](https://agentprime.io/advisories/GHSA-r8xh-cgf7-392j.md)
  `GHSA-r8xh-cgf7-392j`, `CVE-2026-121441`, `RUSTSEC-2026-0376` · crates.io `wasmtime-wasi-http`: affected `>=0.0.0-0, <36.0.19 || >=37.0.0, <48.0.7 || >=49.0.0, <49.0.4`, fixed in `36.0.19`, `48.0.7`, `49.0.4` · CVSS 6.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: HTTP request smuggling
- [\`wasi-http\` p3: Guests can set incorrect content-length for spliced response bodies](https://agentprime.io/advisories/GHSA-9prg-84vf-g5fc.md)
  `GHSA-9prg-84vf-g5fc`, `CVE-2026-121439`, `RUSTSEC-2026-0375` · crates.io `wasmtime-wasi-http`: affected `>=46.0.0, <48.0.7 || >=49.0.0, <49.0.4`, fixed in `48.0.7`, `49.0.4` · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: HTTP request smuggling
- [pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling](https://agentprime.io/advisories/CVE-2026-57488.md)
  `CVE-2026-57488` · CVE record: pupnp pupnp · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Memory corruption, HTTP request smuggling
- [HTTP request smuggling in Eclipse Foundation Eclipse Vert.x](https://agentprime.io/advisories/CVE-2026-102479.md)
  `CVE-2026-102479` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: HTTP request smuggling
- [Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy](https://agentprime.io/advisories/CVE-2026-88829.md)
  `CVE-2026-88829` · CVE record: Red Hat Red Hat Hardened Images · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: HTTP request smuggling
- [Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-rv87-ccxw-8ggf.md)
  `GHSA-rv87-ccxw-8ggf`, `BIT-aspnet-core-2026-88092`, `CVE-2026-88092` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 10 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: HTTP request smuggling
- [Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-fpq8-4vhr-rcxx.md)
  `GHSA-fpq8-4vhr-rcxx`, `CVE-2026-70188` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 10 more: affected `>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2`, fixed in `8.0.32`, `9.0.21`, `10.0.13`, `11.0.0-rc.2` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: HTTP request smuggling
- [Squid Request Smuggling in HTTP Transfer-Encoding](https://agentprime.io/advisories/CVE-2026-61642.md)
  `CVE-2026-61642` · CVE record: squid-cache squid · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: HTTP request smuggling
- [HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http](https://agentprime.io/advisories/GO-2026-6613.md)
  `GO-2026-6613`, `BIT-golang-2026-94439`, `CVE-2026-94439` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: HTTP request smuggling
- [HTTP/2 transport accepts malformed framing-related headers in net/http](https://agentprime.io/advisories/GO-2026-6610.md)
  `GO-2026-6610`, `BIT-golang-2026-78660`, `CVE-2026-78660` · Go `golang.org/x/net` and 1 more: affected `<0.60.0`, fixed in `0.60.0` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: HTTP request smuggling
- [HTTP/1 client connection desynchronization after CONNECT rejection in net/http](https://agentprime.io/advisories/GO-2026-6605.md)
  `GO-2026-6605`, `BIT-golang-2026-56866`, `CVE-2026-56866` · Go `stdlib`: affected `<1.26.9 || >=1.27.0-0, <1.27.2`, fixed in `1.26.9`, `1.27.2` · CVSS 7.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: HTTP request smuggling
- [Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic](https://agentprime.io/advisories/CVE-2026-77803.md)
  `CVE-2026-77803` · CVE record: Progress Software Progress® Telerik® Fiddler® Classic · CVSS 3.6 Low · Not analysed yet · Published 5 Oct 2026 · Tags: HTTP request smuggling
- [HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic](https://agentprime.io/advisories/CVE-2026-77802.md)
  `CVE-2026-77802` · CVE record: Progress Software Progress® Telerik® Fiddler® Classic · CVSS 6.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: HTTP request smuggling
- [Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling](https://agentprime.io/advisories/CVE-2026-63718.md)
  `CVE-2026-63718` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: HTTP request smuggling
- [Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body](https://agentprime.io/advisories/CVE-2026-103399.md)
  `CVE-2026-103399` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: HTTP request smuggling
- [undici vulnerable to downstream response splitting via retry interceptor](https://agentprime.io/advisories/GHSA-r53p-7pc4-xj5r.md)
  `GHSA-r53p-7pc4-xj5r`, `CVE-2026-18540` · npm `undici`: affected `<6.28.1 || >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2`, fixed in `6.28.1`, `7.29.1`, `8.10.2` · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: HTTP request smuggling
- [Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries](https://agentprime.io/advisories/GHSA-gvrc-75rc-7gj9.md)
  `GHSA-gvrc-75rc-7gj9`, `CVE-2026-94194`, `EEF-CVE-2026-94194` · Hex `mint`: affected `>=0.1.0, <1.10.2`, fixed in `1.10.2` · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: HTTP request smuggling
- [HTTP Request Smuggling](https://agentprime.io/advisories/CVE-2026-88773.md)
  `CVE-2026-88773` · CVE record: Citrix NetScaler ADC and 1 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Sept 2026 · Tags: HTTP request smuggling
- [Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec](https://agentprime.io/advisories/CVE-2026-100666.md)
  `CVE-2026-100666` · CVE record: netty netty · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: HTTP request smuggling
- [Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass](https://agentprime.io/advisories/CVE-2026-100659.md)
  `CVE-2026-100659` · CVE record: netty netty · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: HTTP request smuggling
- [Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up](https://agentprime.io/advisories/CVE-2026-86350.md)
  `CVE-2026-86350` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Sept 2026 · Tags: HTTP request smuggling
- [Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests](https://agentprime.io/advisories/CVE-2026-77756.md)
  `CVE-2026-77756` · CVE record: Apache Software Foundation Apache Tomcat · CVSS 3.7 Low · Not analysed yet · Published 23 Sept 2026 · Tags: HTTP request smuggling
- [Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool](https://agentprime.io/advisories/CVE-2026-73548.md)
  `CVE-2026-73548` · CVE record: envoyproxy envoy · CVSS 7.5 High · Not analysed yet · Published 21 Sept 2026 · Tags: HTTP request smuggling
- [Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections](https://agentprime.io/advisories/GHSA-rj5m-69wp-cxq9.md)
  `GHSA-rj5m-69wp-cxq9`, `CVE-2026-82672`, `EEF-CVE-2026-82672` · Hex `mint`: affected `>=0.1.0, <1.10.1`, fixed in `1.10.1` · CVSS 6.3 Medium · Not analysed yet · Published 19 Sept 2026 · Tags: HTTP request smuggling
- [Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing](https://agentprime.io/advisories/CVE-2026-93574.md)
  `CVE-2026-93574` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling](https://agentprime.io/advisories/CVE-2026-11722.md)
  `CVE-2026-11722` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability](https://agentprime.io/advisories/CVE-2026-11710.md)
  `CVE-2026-11710` · CVE record: IBM WebSphere Application Server · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling](https://agentprime.io/advisories/CVE-2026-11548.md)
  `CVE-2026-11548` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling](https://agentprime.io/advisories/CVE-2026-10841.md)
  `CVE-2026-10841` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 4.8 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling](https://agentprime.io/advisories/CVE-2026-93573.md)
  `CVE-2026-93573` · CVE record: Red Hat Red Hat Build of Debezium 3.6 and 4 more · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority](https://agentprime.io/advisories/CVE-2026-93569.md)
  `CVE-2026-93569` · CVE record: Red Hat Red Hat Build of Apache Camel 3.33.3.SP2 and 4 more · CVSS 8.2 High · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters](https://agentprime.io/advisories/CVE-2026-79713.md)
  `CVE-2026-79713` · CVE record: Unknown Breeze Cache · CVSS 6.5 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: HTTP request smuggling
- [sanic chunked trailer request smuggling allows hidden second request execution](https://agentprime.io/advisories/GHSA-wmj6-g64g-j7q5.md)
  `GHSA-wmj6-g64g-j7q5`, `CVE-2026-85078`, `PYSEC-2026-4162` · PyPI `sanic`: affected `<24.12.1 || >=25.12.0, <25.12.1`, fixed in `24.12.1`, `25.12.1` · CVSS 6.5 Medium · Not analysed yet · Published 17 Sept 2026 · Tags: HTTP request smuggling
- [Http4s: Ember chunk parser lenience (TE.TE request smuggling)](https://agentprime.io/advisories/GHSA-jrpm-956j-96jg.md)
  `GHSA-jrpm-956j-96jg`, `CVE-2026-69216` · Maven `org.http4s:http4s-ember-core_2.12` and 2 more: affected `<0.23.35`, fixed in `0.23.35` · CVSS 5.4 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: HTTP request smuggling
- [Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)](https://agentprime.io/advisories/GHSA-9998-894r-fwvr.md)
  `GHSA-9998-894r-fwvr`, `CVE-2026-69205` · Maven `org.http4s:http4s-ember-core_2.12` and 2 more: affected `<0.23.35`, fixed in `0.23.35` · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: HTTP request smuggling
- [Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)](https://agentprime.io/advisories/GHSA-8h4c-x2wg-6xp8.md)
  `GHSA-8h4c-x2wg-6xp8`, `CVE-2026-69204` · Maven `org.http4s:http4s-ember-core_2.12` and 2 more: affected `<0.23.35`, fixed in `0.23.35` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: HTTP request smuggling
- [Ambiguous parsing of mail headers](https://agentprime.io/advisories/CVE-2026-92238.md)
  `CVE-2026-92238` · CVE record: Mozilla Thunderbird · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Sept 2026 · Tags: HTTP request smuggling
- [Http4s: Ember Server accepts duplicate Content-Length headers](https://agentprime.io/advisories/CVE-2026-69217.md)
  `CVE-2026-69217` · CVE record: http4s http4s · CVSS 8.7 High · Not analysed yet · Published 15 Sept 2026 · Tags: HTTP request smuggling

Older: <https://agentprime.io/advisories/tag/request-smuggling.md?cursor=WyIyMDI2LTA5LTE1VDE5OjIwOjAyLjkwMjAwMFoiLCJDVkUtMjAyNi02OTIxNyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=request-smuggling>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/request-smuggling/>. Everything for agents: <https://agentprime.io/llms.txt>.