# HTTP request smuggling.

Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling](https://agentprime.io/advisories/GHSA-cxrx-q234-m22m.md)
  `GHSA-cxrx-q234-m22m`, `CVE-2024-12397` · Maven `io.quarkus.http:quarkus-http-core`: affected `<5.3.4`, fixed in `5.3.4` · CVSS 7.4 High · Not analysed yet · Published 12 Dec 2024 · Tags: HTTP request smuggling
- [HTTP request smuggling in HAProxy Project HAProxy 2.6 and others](https://agentprime.io/advisories/CVE-2024-53008.md)
  `CVE-2024-53008` · CVE record: HAProxy Project HAProxy 2.6 and 3 more · CVSS 5.3 Medium · Not analysed yet · Published 28 Nov 2024 · Tags: HTTP request smuggling
- [Keycloak proxy header handling Denial-of-Service (DoS) vulnerability](https://agentprime.io/advisories/GHSA-jgwc-jh89-rpgq.md)
  `GHSA-jgwc-jh89-rpgq`, `CVE-2024-9666` · Maven `org.keycloak:keycloak-quarkus-server`: affected `* || >=25.0.0, <26.0.6`, fixed in `26.0.6` · CVSS 4.7 Medium · Not analysed yet · Published 25 Nov 2024 · Tags: HTTP request smuggling
- [Duplicate Advisory: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability](https://agentprime.io/advisories/GHSA-pcx7-8hxg-j823.md)
  `GHSA-pcx7-8hxg-j823` · Maven `org.keycloak:keycloak-quarkus-server`: affected `<24.0.9 || >=25.0.0, <26.0.6`, fixed in `24.0.9`, `26.0.6` · CVSS 4.7 Medium · Withdrawn · Not analysed yet · Published 25 Nov 2024 · Tags: HTTP request smuggling
- [aiohttp allows request smuggling due to incorrect parsing of chunk extensions](https://agentprime.io/advisories/GHSA-8495-4g3g-x7pr.md)
  `GHSA-8495-4g3g-x7pr`, `CVE-2024-52304`, `PYSEC-2026-1103` · PyPI `aiohttp`: affected `<3.10.11`, fixed in `3.10.11` · CVSS 6.3 Medium · Not analysed yet · Published 18 Nov 2024 · Tags: HTTP request smuggling
- [Undertow incorrectly parses cookies](https://agentprime.io/advisories/GHSA-3jrv-jgp8-45v3.md)
  `GHSA-3jrv-jgp8-45v3`, `CVE-2023-4639` · Maven `io.undertow:undertow-core`: affected `>=2.3.0.Alpha1, <2.3.11.Final || <2.2.30.Final`, fixed in `2.3.11.Final`, `2.2.30.Final` · CVSS 7.4 High · Not analysed yet · Published 17 Nov 2024 · Tags: HTTP request smuggling
- [GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treate…](https://agentprime.io/advisories/CVE-2024-52530.md)
  `CVE-2024-52530` · CVE record · CVSS 7.5 High · Not analysed yet · Published 11 Nov 2024 · Tags: HTTP request smuggling
- [Waitress has request processing race condition in HTTP pipelining with invalid first request](https://agentprime.io/advisories/GHSA-9298-4cf8-g4wj.md)
  `GHSA-9298-4cf8-g4wj`, `CVE-2024-49768`, `PYSEC-2024-210` · PyPI `waitress`: affected `>=2.0.0, <3.0.1`, fixed in `3.0.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2024 · Tags: Race condition, HTTP request smuggling
- [HTTP request smuggling in Oracle Corporation Oracle Banking Liquidity Management](https://agentprime.io/advisories/CVE-2024-21281.md)
  `CVE-2024-21281` · CVE record: Oracle Corporation Oracle Banking Liquidity Management · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2024 · Tags: HTTP request smuggling
- [kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception.](https://agentprime.io/advisories/CVE-2024-44775.md)
  `CVE-2024-44775` · CVE record · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2024 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Looker](https://agentprime.io/advisories/CVE-2024-8912.md)
  `CVE-2024-8912` · CVE record: Google Looker · CVSS 8.9 High · Not analysed yet · Published 11 Oct 2024 · Tags: HTTP request smuggling
- [HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4](https://agentprime.io/advisories/GHSA-5wpr-cj9p-959r.md)
  `GHSA-5wpr-cj9p-959r`, `CVE-2024-9622` · Maven `org.jboss.resteasy:resteasy-netty4-cdi`: affected `*`, no fixed version yet · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2024 · Tags: HTTP request smuggling
- [Erroneous parsing of multipart form data](https://agentprime.io/advisories/CVE-2024-8925.md)
  `CVE-2024-8925` · CVE record: PHP Group PHP · CVSS 3.1 Low · Not analysed yet · Published 8 Oct 2024 · Tags: HTTP request smuggling
- [In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.](https://agentprime.io/advisories/CVE-2024-34535.md)
  `CVE-2024-34535` · CVE record · CVSS 5.9 Medium · Not analysed yet · Published 3 Oct 2024 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in ruby webrick](https://agentprime.io/advisories/GHSA-6f62-3596-g6w7.md)
  `GHSA-6f62-3596-g6w7`, `CVE-2024-47220` · RubyGems `webrick`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 7.5 High · Not analysed yet · Published 22 Sept 2024 · Tags: HTTP request smuggling
- [Puma's header normalization allows for client to clobber proxy set headers](https://agentprime.io/advisories/GHSA-9hf4-67fc-4vf4.md)
  `GHSA-9hf4-67fc-4vf4`, `CVE-2024-45614` · RubyGems `puma`: affected `<5.6.9 || >=6.0.0, <6.4.3`, fixed in `5.6.9`, `6.4.3` · CVSS 5.4 Medium · Not analysed yet · Published 20 Sept 2024 · Tags: HTTP request smuggling, Broken access control
- [Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')](https://agentprime.io/advisories/CVE-2024-42342.md)
  `CVE-2024-42342` · CVE record: Loway QueueMetrics · CVSS 4.3 Medium · Not analysed yet · Published 8 Sept 2024 · Tags: HTTP request smuggling
- [\[20240802\] - Core - Cache Poisoning in Pagination](https://agentprime.io/advisories/CVE-2024-27185.md)
  `CVE-2024-27185` · CVE record: Joomla! Project Joomla! CMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2024 · Tags: HTTP request smuggling
- [Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-I…](https://agentprime.io/advisories/CVE-2024-35538.md)
  `CVE-2024-35538` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 19 Aug 2024 · Tags: Authentication bypass, HTTP request smuggling
- [Authz zero length regression](https://agentprime.io/advisories/GHSA-v23v-6jw2-98fq.md)
  `GHSA-v23v-6jw2-98fq`, `CVE-2024-41110`, `GO-2024-3005` · Go `github.com/docker/docker`: affected `>=19.03.0, <23.0.15 || >=24.0.0, <25.0.6 || >=26.0.0, <26.1.5 || >=27.0.0, <27.1.1`, fixed in `23.0.15`, `25.0.6`, `26.1.5`, `27.1.1` · CVSS 10.0 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.16 · Not analysed yet · Published 30 Jul 2024 · Tags: HTTP request smuggling, Broken access control, CWE-187
- [twisted.web has disordered HTTP pipeline response](https://agentprime.io/advisories/GHSA-c8m8-j448-xjx7.md)
  `GHSA-c8m8-j448-xjx7`, `CVE-2024-41671`, `PYSEC-2026-1992` · PyPI `twisted`: affected `<24.7.0rc1`, fixed in `24.7.0rc1` · CVSS 8.3 High · Not analysed yet · Published 29 Jul 2024 · Tags: HTTP request smuggling
- [Apache Traffic Server: Incomplete field name check allows request smuggling](https://agentprime.io/advisories/CVE-2023-38522.md)
  `CVE-2023-38522` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 26 Jul 2024 · Tags: HTTP request smuggling
- [Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling](https://agentprime.io/advisories/CVE-2024-35161.md)
  `CVE-2024-35161` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Jul 2024 · Tags: HTTP request smuggling
- [Symantec Privileged Access Manager Remote Command Execution vulnerability](https://agentprime.io/advisories/CVE-2024-38494.md)
  `CVE-2024-38494` · CVE record: Broadcom Symantec Privileged Access Management · CVSS 8.6 High · Not analysed yet · Published 15 Jul 2024 · Tags: HTTP request smuggling
- [mhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smuggling](https://agentprime.io/advisories/CVE-2016-15039.md)
  `CVE-2016-15039` · CVE record: mhuertos phpLDAPadmin · CVSS 5.3 Medium · Not analysed yet · Published 11 Jul 2024 · Tags: HTTP request smuggling
- [GoRouter Denial of Service Attack](https://agentprime.io/advisories/CVE-2024-22279.md)
  `CVE-2024-22279` · CVE record: Cloud Foundry Routing Release · CVSS 5.9 Medium · Not analysed yet · Published 10 Jun 2024 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado](https://agentprime.io/advisories/GHSA-753j-mpmx-qq6g.md)
  `GHSA-753j-mpmx-qq6g`, `CVE-2024-14029` · PyPI `tornado`: affected `<6.4.1`, fixed in `6.4.1` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: HTTP request smuggling
- [PingAccess HTTP Request Desynchronization Weakness](https://agentprime.io/advisories/CVE-2024-23316.md)
  `CVE-2024-23316` · CVE record: Ping Identity PingAccess · CVSS 8.8 High · Not analysed yet · Published 31 May 2024 · Tags: HTTP request smuggling
- [Next.js Vulnerable to HTTP Request Smuggling](https://agentprime.io/advisories/GHSA-77r5-gw3j-2mpf.md)
  `GHSA-77r5-gw3j-2mpf`, `CVE-2024-34350` · npm `next`: affected `>=13.4.0, <13.5.1`, fixed in `13.5.1` · CVSS 7.5 High · Not analysed yet · Published 9 May 2024 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2024-27982.md)
  `CVE-2024-27982` · CVE record: NodeJS Node · CVSS 6.5 Medium · Not analysed yet · Published 7 May 2024 · Tags: HTTP request smuggling
- [Apache APISIX: Forward-Auth Request Smuggling](https://agentprime.io/advisories/CVE-2024-32638.md)
  `CVE-2024-32638` · CVE record: Apache Software Foundation Apache APISIX · CVSS 6.3 Medium · Not analysed yet · Published 2 May 2024 · Tags: HTTP request smuggling
- [HTTP request smuggling in Oracle Corporation Production Scheduling](https://agentprime.io/advisories/CVE-2024-21088.md)
  `CVE-2024-21088` · CVE record: Oracle Corporation Production Scheduling · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2024 · Tags: HTTP request smuggling
- [Request smuggling leading to endpoint restriction bypass in Gunicorn](https://agentprime.io/advisories/GHSA-w3h3-4rj7-4ph4.md)
  `GHSA-w3h3-4rj7-4ph4`, `CVE-2024-1135`, `PYSEC-2026-1434` · PyPI `gunicorn`: affected `<22.0.0`, fixed in `22.0.0` · CVSS 7.5 High · Not analysed yet · Published 16 Apr 2024 · Tags: HTTP request smuggling
- [Apache HTTP Server: HTTP Response Splitting in multiple modules](https://agentprime.io/advisories/CVE-2024-24795.md)
  `CVE-2024-24795` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 6.3 Medium · Not analysed yet · Published 4 Apr 2024 · Tags: Other injection, HTTP request smuggling
- [An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.](https://agentprime.io/advisories/CVE-2024-22081.md)
  `CVE-2024-22081` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2024 · Tags: HTTP request smuggling
- [Cross-Site Request Forgery in Apache Wicket](https://agentprime.io/advisories/GHSA-8vvp-525h-cxf9.md)
  `GHSA-8vvp-525h-cxf9`, `CVE-2024-27439` · Maven `org.apache.wicket:wicket`: affected `>=9.1.0, <9.17.0 || >=10.0.0-M1, <10.0.0`, fixed in `9.17.0`, `10.0.0` · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: Cross-site request forgery (CSRF), HTTP request smuggling
- [An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception.](https://agentprime.io/advisories/CVE-2023-50811.md)
  `CVE-2023-50811` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 19 Mar 2024 · Tags: HTTP request smuggling, Broken access control
- [HTTP Handling Vulnerability in the Bare server](https://agentprime.io/advisories/GHSA-86fc-f9gr-v533.md)
  `GHSA-86fc-f9gr-v533`, `CVE-2024-27922` · npm `@tomphttp/bare-server-node`: affected `<2.0.2`, fixed in `2.0.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2024 · Tags: HTTP request smuggling
- [SMTP smuggling in Apache James](https://agentprime.io/advisories/GHSA-p5q9-86w4-2xr5.md)
  `GHSA-p5q9-86w4-2xr5`, `CVE-2023-51747` · Maven `org.apache.james:james-server`: affected `<3.7.5 || >=3.8.0, <3.8.1`, fixed in `3.7.5`, `3.8.1` · CVSS 7.1 High · Not analysed yet · Published 27 Feb 2024 · Tags: Authentication bypass, HTTP request smuggling, CWE-20
- [HTTP request smuggling in Oracle Corporation Application Object Library](https://agentprime.io/advisories/CVE-2024-20915.md)
  `CVE-2024-20915` · CVE record: Oracle Corporation Application Object Library · CVSS 5.3 Medium · Not analysed yet · Published 17 Feb 2024 · Tags: HTTP request smuggling
- [Apache bRPC: HTTP request smuggling vulnerability](https://agentprime.io/advisories/CVE-2024-23452.md)
  `CVE-2024-23452` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 8 Feb 2024 · Tags: HTTP request smuggling
- [aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators](https://agentprime.io/advisories/GHSA-8qpw-xqxj-h4r2.md)
  `GHSA-8qpw-xqxj-h4r2`, `CVE-2024-23829`, `PYSEC-2024-26` · PyPI `aiohttp`: affected `<3.9.2`, fixed in `3.9.2` · CVSS 6.5 Medium · Not analysed yet · Published 29 Jan 2024 · Tags: HTTP request smuggling
- [chasquid HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-g4x3-mfpj-f335.md)
  `GHSA-g4x3-mfpj-f335`, `CVE-2023-52354`, `GO-2024-2478` · Go `github.com/albertito/chasquid`: affected `<1.13`, fixed in `1.13` · CVSS 7.5 High · Not analysed yet · Published 22 Jan 2024 · Tags: HTTP request smuggling
- [Puma HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-c2f4-cvqm-65w2.md)
  `GHSA-c2f4-cvqm-65w2`, `CVE-2024-21647` · RubyGems `puma`: affected `<5.6.8 || >=6.0.0, <6.4.2`, fixed in `5.6.8`, `6.4.2` · CVSS 5.9 Medium · Not analysed yet · Published 8 Jan 2024 · Tags: HTTP request smuggling
- [@fastify/reply-from JSON Content-Type parsing confusion](https://agentprime.io/advisories/GHSA-v2v2-hph8-q5xp.md)
  `GHSA-v2v2-hph8-q5xp`, `CVE-2023-51701` · npm `@fastify/reply-from`: affected `<9.6.0`, fixed in `9.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 8 Jan 2024 · Tags: HTTP request smuggling
- [Client-Side Desynchronization vulnerability in SAP Fiori Launchpad](https://agentprime.io/advisories/CVE-2023-49584.md)
  `CVE-2023-49584` · CVE record: SAP_SE SAP Fiori Launchpad · CVSS 4.3 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: HTTP request smuggling
- [Apache Tomcat Improper Input Validation vulnerability](https://agentprime.io/advisories/GHSA-fccv-jmmp-qg76.md)
  `GHSA-fccv-jmmp-qg76`, `BIT-tomcat-2023-46589`, `CVE-2023-46589` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 2 more: affected `>=11.0.0-M1, <11.0.0-M11 || >=10.1.0-M1, <10.1.16 || >=9.0.0-M1, <9.0.83 || >=8.5.0, <8.5.96`, fixed in `11.0.0-M11`, `10.1.16`, `9.0.83`, `8.5.96` · CVSS 7.5 High · Not analysed yet · Published 28 Nov 2023 · Tags: HTTP request smuggling, CWE-20
- [aiohttp has vulnerable dependency that is vulnerable to request smuggling](https://agentprime.io/advisories/GHSA-pjjw-qhg8-p2p9.md)
  `GHSA-pjjw-qhg8-p2p9` · PyPI `aiohttp`: affected `<3.8.6`, fixed in `3.8.6` · No CVSS score · Not analysed yet · Published 27 Nov 2023 · Tags: HTTP request smuggling
- [yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection](https://agentprime.io/advisories/GHSA-3ch3-jhc6-5r8x.md)
  `GHSA-3ch3-jhc6-5r8x`, `CVE-2023-46121`, `PYSEC-2026-2063` · PyPI `yt-dlp`: affected `>=2022.10.04, <2023.11.14`, fixed in `2023.11.14` · CVSS 5.0 Medium · Not analysed yet · Published 15 Nov 2023 · Tags: HTTP request smuggling, Authentication bypass
- [Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.](https://agentprime.io/advisories/CVE-2023-48365.md)
  `CVE-2023-48365` · CVE record · CVSS 9.6 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.48 · Not analysed yet · Published 15 Nov 2023 · Tags: HTTP request smuggling
- [AIOHTTP has problems in HTTP parser (the python one, not llhttp)](https://agentprime.io/advisories/GHSA-gfw2-4jvh-wgfg.md)
  `GHSA-gfw2-4jvh-wgfg`, `CVE-2023-47627`, `PYSEC-2023-246` · PyPI `aiohttp`: affected `<3.8.6`, fixed in `3.8.6` · CVSS 5.3 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: HTTP request smuggling
- [Aiohttp has inconsistent interpretation of \`Content-Length\` vs. \`Transfer-Encoding\` differing in C and Python fallbacks](https://agentprime.io/advisories/GHSA-xx9p-xxvh-7g8j.md)
  `GHSA-xx9p-xxvh-7g8j`, `CVE-2023-47641`, `PYSEC-2023-247` · PyPI `aiohttp`: affected `<3.8.0`, fixed in `3.8.0` · CVSS 3.4 Low · Not analysed yet · Published 14 Nov 2023 · Tags: HTTP request smuggling
- [Squid: request/response smuggling in http/1.1 and icap](https://agentprime.io/advisories/CVE-2023-46846.md)
  `CVE-2023-46846` · CVE record: Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2023 · Tags: HTTP request smuggling
- [twisted.web has disordered HTTP pipeline response](https://agentprime.io/advisories/GHSA-xc8x-vp79-p3wm.md)
  `GHSA-xc8x-vp79-p3wm`, `CVE-2023-46137`, `PYSEC-2023-224` · PyPI `twisted`: affected `<23.10.0rc1`, fixed in `23.10.0rc1` · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2023 · Tags: HTTP request smuggling
- [HTTP request smuggling in Hewlett Packer Enterprise (HPE) HPE MSA Controller](https://agentprime.io/advisories/CVE-2023-30910.md)
  `CVE-2023-30910` · CVE record: Hewlett Packer Enterprise (HPE) HPE MSA Controller · CVSS 5.4 Medium · Not analysed yet · Published 9 Oct 2023 · Tags: HTTP request smuggling
- [An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, an…](https://agentprime.io/advisories/CVE-2023-41265.md)
  `CVE-2023-41265` · CVE record · CVSS 9.6 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.88 · Not analysed yet · Published 29 Aug 2023 · Tags: HTTP request smuggling
- [Puma HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-68xg-gqqm-vgj8.md)
  `GHSA-68xg-gqqm-vgj8`, `CVE-2023-40175` · RubyGems `puma`: affected `<5.6.7 || >=6.0.0, <6.3.1`, fixed in `5.6.7`, `6.3.1` · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2023 · Tags: HTTP request smuggling
- [Tornado vulnerable to HTTP request smuggling via improper parsing of \`Content-Length\` fields and chunk lengths](https://agentprime.io/advisories/GHSA-qppv-j76h-2rpx.md)
  `GHSA-qppv-j76h-2rpx`, `CVE-2023-54397` · PyPI `tornado`: affected `<6.3.3`, fixed in `6.3.3` · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2023 · Tags: HTTP request smuggling
- [Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies](https://agentprime.io/advisories/CVE-2023-33934.md)
  `CVE-2023-33934` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Aug 2023 · Tags: HTTP request smuggling
- [protocol-http1 HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-6jwc-qr2q-7xwj.md)
  `GHSA-6jwc-qr2q-7xwj`, `CVE-2023-38697` · RubyGems `protocol-http1`: affected `<0.15.1`, fixed in `0.15.1` · CVSS 5.8 Medium · Not analysed yet · Published 3 Aug 2023 · Tags: HTTP request smuggling

Newest: <https://agentprime.io/advisories/tag/request-smuggling.md>
Older: <https://agentprime.io/advisories/tag/request-smuggling.md?cursor=WyIyMDIzLTA4LTAzVDE2OjM2OjM0LjAwMDAwMFoiLCJHSFNBLTZqd2MtcXIycS03eHdqIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=request-smuggling&cursor=WyIyMDI0LTEyLTE0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yOTQ3NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/request-smuggling/?cursor=WyIyMDI0LTEyLTE0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yOTQ3NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.