# HTTP request smuggling.

Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling](https://agentprime.io/advisories/CVE-2026-15396.md)
  `CVE-2026-15396` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling](https://agentprime.io/advisories/CVE-2026-15634.md)
  `CVE-2026-15634` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: HTTP request smuggling
- [Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization](https://agentprime.io/advisories/GHSA-w4v4-9rw7-5326.md)
  `GHSA-w4v4-9rw7-5326`, `CVE-2026-88008`, `GO-2026-6468` · Go `github.com/traefik/traefik/v2` and 1 more: affected `>=2.11.26, <2.11.57`, fixed in `2.11.57` · CVSS 7.0 High · Not analysed yet · Published 10 Sept 2026 · Tags: HTTP request smuggling, Broken access control
- [Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging](https://agentprime.io/advisories/GHSA-f52w-8j3h-j724.md)
  `GHSA-f52w-8j3h-j724`, `CVE-2026-88009`, `GO-2026-6465` · Go `github.com/traefik/traefik/v2` and 1 more: affected `<2.11.57`, fixed in `2.11.57` · CVSS 8.8 High · Not analysed yet · Published 10 Sept 2026 · Tags: HTTP request smuggling, CWE-1286
- [Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding](https://agentprime.io/advisories/CVE-2026-89044.md)
  `CVE-2026-89044` · CVE record: netty netty · CVSS 6.9 Medium · Not analysed yet · Published 10 Sept 2026 · Tags: HTTP request smuggling
- [An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file](https://agentprime.io/advisories/CVE-2026-68006.md)
  `CVE-2026-68006` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Sept 2026 · Tags: HTTP request smuggling
- [Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials](https://agentprime.io/advisories/GHSA-crvj-82cr-hjcx.md)
  `GHSA-crvj-82cr-hjcx`, `CVE-2026-84363` · npm `hono`: affected `<4.13.5`, fixed in `4.13.5` · CVSS 5.9 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: HTTP request smuggling
- [HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated](https://agentprime.io/advisories/GHSA-pf96-p4fj-6566.md)
  `GHSA-pf96-p4fj-6566`, `CVE-2026-84380`, `PYSEC-2026-3849` · PyPI `httpx2`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 5.6 Medium · Not analysed yet · Published 8 Sept 2026 · Tags: HTTP request smuggling
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-81356.md)
  `CVE-2026-81356` · CVE record: Microsoft Visual Studio Code · CVSS 8.2 High · Not analysed yet · Published 8 Sept 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in Eclipse Foundation Eclipse Jetty](https://agentprime.io/advisories/CVE-2026-19203.md)
  `CVE-2026-19203` · CVE record: Eclipse Foundation Eclipse Jetty · CVSS 8.3 High · Not analysed yet · Published 8 Sept 2026 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-78605.md)
  `CVE-2026-78605` · CVE record: Elastic Elasticsearch · CVSS 5.9 Medium · Not analysed yet · Published 1 Sept 2026 · Tags: HTTP request smuggling
- [inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length](https://agentprime.io/advisories/CVE-2026-73812.md)
  `CVE-2026-73812` · CVE record: Erlang OTP · CVSS 8.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: HTTP request smuggling
- [inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i](https://agentprime.io/advisories/CVE-2026-73276.md)
  `CVE-2026-73276` · CVE record: Erlang OTP · CVSS 8.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: HTTP request smuggling
- [inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation](https://agentprime.io/advisories/CVE-2026-66357.md)
  `CVE-2026-66357` · CVE record: Erlang OTP · CVSS 8.3 High · Not analysed yet · Published 1 Sept 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in node](https://agentprime.io/advisories/CVE-2026-48932.md)
  `CVE-2026-48932` · CVE record: nodejs node · CVSS 3.7 Low · Not analysed yet · Published 1 Sept 2026 · Tags: HTTP request smuggling
- [An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache](https://agentprime.io/advisories/CVE-2026-51376.md)
  `CVE-2026-51376` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 28 Aug 2026 · Tags: HTTP request smuggling
- [Apache APISIX: Cross-user response poisoning in serverless plugins](https://agentprime.io/advisories/CVE-2026-74848.md)
  `CVE-2026-74848` · CVE record: Apache Software Foundation Apache APISIX · CVSS 7.0 High · Not analysed yet · Published 27 Aug 2026 · Tags: HTTP request smuggling
- [Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line](https://agentprime.io/advisories/CVE-2026-75922.md)
  `CVE-2026-75922` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 23 Aug 2026 · Tags: Other injection, HTTP request smuggling
- [Libevent: HTTP header handling bugs create risk of access control bypass.](https://agentprime.io/advisories/CVE-2026-63385.md)
  `CVE-2026-63385` · CVE record: libevent libevent · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [Libevent: HTTP Header smuggling](https://agentprime.io/advisories/CVE-2026-63379.md)
  `CVE-2026-63379` · CVE record: libevent libevent · CVSS 6.3 Medium · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling](https://agentprime.io/advisories/CVE-2026-63382.md)
  `CVE-2026-63382` · CVE record: libevent libevent · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE](https://agentprime.io/advisories/CVE-2026-73256.md)
  `CVE-2026-73256` · CVE record: cesanta mongoose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling](https://agentprime.io/advisories/CVE-2026-73257.md)
  `CVE-2026-73257` · CVE record: cesanta mongoose · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Aug 2026 · Tags: HTTP request smuggling
- [ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header](https://agentprime.io/advisories/GHSA-fjgc-3mj7-8rg8.md)
  `GHSA-fjgc-3mj7-8rg8`, `CVE-2026-55087` · npm `ep_etherpad-lite`: affected `>=2.1.0, <3.1.0`, fixed in `3.1.0` · CVSS 6.1 Medium · Not analysed yet · Published 13 Aug 2026 · Tags: Cross-site scripting (XSS), HTTP request smuggling, Open redirect
- [HTTP request smuggling in Apple servicetalk](https://agentprime.io/advisories/CVE-2026-65370.md)
  `CVE-2026-65370` · CVE record: Apple servicetalk · CVSS 7.5 High · Not analysed yet · Published 12 Aug 2026 · Tags: HTTP request smuggling
- [Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-r6mh-95jw-g7qg.md)
  `GHSA-r6mh-95jw-g7qg`, `BIT-dotnet-2026-62899`, `BIT-dotnet-sdk-2026-62899`, `CVE-2026-62899` · NuGet `Microsoft.NETCore.App.Runtime.linux-arm` and 7 more: affected `>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11`, fixed in `8.0.30`, `9.0.19`, `10.0.11` · CVSS 5.9 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: HTTP request smuggling
- [Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap](https://agentprime.io/advisories/CVE-2026-14180.md)
  `CVE-2026-14180` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1.8.GA and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 11 Aug 2026 · Tags: HTTP request smuggling
- [Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint](https://agentprime.io/advisories/CVE-2026-72587.md)
  `CVE-2026-72587` · CVE record: CoreBunch Instatic · CVSS 6.1 Medium · Not analysed yet · Published 10 Aug 2026 · Tags: HTTP request smuggling
- [h2: Duplicate Host header could facilitate request smuggling](https://agentprime.io/advisories/GHSA-6hr6-w5qg-qmwg.md)
  `GHSA-6hr6-w5qg-qmwg`, `CVE-2026-71554`, `PYSEC-2026-3628` · PyPI `h2`: affected `<4.4.1`, fixed in `4.4.1` · CVSS 5.3 Medium · Not analysed yet · Published 6 Aug 2026 · Tags: HTTP request smuggling
- [Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool](https://agentprime.io/advisories/GHSA-3ccp-42pg-hgv6.md)
  `GHSA-3ccp-42pg-hgv6`, `CVE-2026-71324`, `GO-2026-6201` · Go `github.com/traefik/traefik` and 2 more: affected `<=1.7.34`, no fixed version yet · CVSS 7.0 High · Not analysed yet · Published 6 Aug 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-9190.md)
  `CVE-2026-9190` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Aug 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in node](https://agentprime.io/advisories/CVE-2026-58044.md)
  `CVE-2026-58044` · CVE record: nodejs node · CVSS 3.7 Low · Not analysed yet · Published 4 Aug 2026 · Tags: HTTP request smuggling
- [AIOHTTP: HTTP request smuggling via WebSocket upgrade](https://agentprime.io/advisories/GHSA-mfx4-hv73-q22v.md)
  `GHSA-mfx4-hv73-q22v`, `CVE-2026-69243`, `PYSEC-2026-3546` · PyPI `aiohttp`: affected `<3.14.2`, fixed in `3.14.2` · CVSS 6.3 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: HTTP request smuggling
- [undici vulnerable to downstream response desynchronization via retry interceptor](https://agentprime.io/advisories/GHSA-8xcm-r25x-g524.md)
  `GHSA-8xcm-r25x-g524`, `CVE-2026-16728` · npm `undici`: affected `<6.28.0 || >=7.0.0, <7.29.0 || >=8.0.0, <8.9.0`, fixed in `6.28.0`, `7.29.0`, `8.9.0` · CVSS 4.8 Medium · Not analysed yet · Published 3 Aug 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in WebPros cPanel and others](https://agentprime.io/advisories/CVE-2026-58047.md)
  `CVE-2026-58047` · CVE record: WebPros cPanel and 1 more · CVSS 5.6 Medium · Not analysed yet · Published 31 Jul 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling](https://agentprime.io/advisories/CVE-2026-58155.md)
  `CVE-2026-58155` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Jul 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely](https://agentprime.io/advisories/CVE-2026-58153.md)
  `CVE-2026-58153` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.3 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling](https://agentprime.io/advisories/CVE-2026-58150.md)
  `CVE-2026-58150` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.8 High · Not analysed yet · Published 29 Jul 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: Malformed chunked message body allows request smuggling](https://agentprime.io/advisories/CVE-2026-57834.md)
  `CVE-2026-57834` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.0 High · Not analysed yet · Published 29 Jul 2026 · Tags: HTTP request smuggling
- [Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing](https://agentprime.io/advisories/CVE-2026-24033.md)
  `CVE-2026-24033` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.9 Medium · Not analysed yet · Published 29 Jul 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-15064.md)
  `CVE-2026-15064` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-15325.md)
  `CVE-2026-15325` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 8.7 High · Not analysed yet · Published 28 Jul 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests](https://agentprime.io/advisories/CVE-2026-15328.md)
  `CVE-2026-15328` · CVE record: IBM WebSphere Application Server and 1 more · CVSS 7.4 High · Not analysed yet · Published 28 Jul 2026 · Tags: HTTP request smuggling
- [Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection](https://agentprime.io/advisories/CVE-2026-67182.md)
  `CVE-2026-67182` · CVE record: tomaka rouille · CVSS 6.9 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: HTTP request smuggling
- [Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header](https://agentprime.io/advisories/CVE-2026-67181.md)
  `CVE-2026-67181` · CVE record: tomaka rouille · CVSS 6.3 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: HTTP request smuggling
- [tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling](https://agentprime.io/advisories/CVE-2026-66752.md)
  `CVE-2026-66752` · CVE record: tiny-http tiny-http · CVSS 6.3 Medium · Not analysed yet · Published 28 Jul 2026 · Tags: HTTP request smuggling
- [Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()](https://agentprime.io/advisories/CVE-2026-66338.md)
  `CVE-2026-66338` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 24 Jul 2026 · Tags: HTTP request smuggling
- [blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)](https://agentprime.io/advisories/GHSA-46q4-43ph-c6fr.md)
  `GHSA-46q4-43ph-c6fr`, `CVE-2026-73495` · Maven `org.http4s:blaze-http_2.12` and 2 more: affected `<0.23.18`, fixed in `0.23.18` · CVSS 7.4 High · Not analysed yet · Published 24 Jul 2026 · Tags: HTTP request smuggling
- [blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser](https://agentprime.io/advisories/GHSA-mhvj-jhpq-885v.md)
  `GHSA-mhvj-jhpq-885v`, `CVE-2026-73494` · Maven `org.http4s:blaze-http_2.13` and 2 more: affected `<0.23.18 || >=1.0.0-M1, <1.0.0-M42`, fixed in `0.23.18`, `1.0.0-M42` · CVSS 7.4 High · Not analysed yet · Published 24 Jul 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in Apple swift-nio-http2](https://agentprime.io/advisories/CVE-2026-64785.md)
  `CVE-2026-64785` · CVE record: Apple swift-nio-http2 · CVSS 5.3 Medium · Not analysed yet · Published 23 Jul 2026 · Tags: HTTP request smuggling
- [Netty: \[codec-http2\] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass](https://agentprime.io/advisories/GHSA-c69g-56f8-xwqj.md)
  `GHSA-c69g-56f8-xwqj`, `CVE-2026-59900` · Maven `io.netty:netty-codec-http2`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.9 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: HTTP request smuggling
- [Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation](https://agentprime.io/advisories/GHSA-4mp9-239f-g9hg.md)
  `GHSA-4mp9-239f-g9hg`, `CVE-2026-59898` · Maven `io.netty:netty-codec-http`: affected `>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 6.3 Medium · Not analysed yet · Published 22 Jul 2026 · Tags: HTTP request smuggling
- [Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies](https://agentprime.io/advisories/GHSA-8qqm-fp2q-v734.md)
  `GHSA-8qqm-fp2q-v734`, `CVE-2026-65838`, `GO-2026-6019` · Go `github.com/zalando/skipper`: affected `<0.27.26`, fixed in `0.27.26` · CVSS 8.2 High · Not analysed yet · Published 17 Jul 2026 · Tags: HTTP request smuggling, CWE-754
- [Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections](https://agentprime.io/advisories/GHSA-x3x7-96vm-6h2w.md)
  `GHSA-x3x7-96vm-6h2w`, `CVE-2026-59249`, `EEF-CVE-2026-59249` · Hex `mint`: affected `>=0.1.0, <1.9.3`, fixed in `1.9.3` · CVSS 6.3 Medium · Not analysed yet · Published 16 Jul 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in Eclipse Foundation Eclipse GlassFish](https://agentprime.io/advisories/CVE-2026-12606.md)
  `CVE-2026-12606` · CVE record: Eclipse Foundation Eclipse GlassFish · CVSS 6.3 Medium · Not analysed yet · Published 14 Jul 2026 · Tags: HTTP request smuggling
- [SAP Approuter Vulnerable to HTTP Request Smuggling](https://agentprime.io/advisories/GHSA-8m85-wqg7-c529.md)
  `GHSA-8m85-wqg7-c529`, `CVE-2026-27690` · npm `@sap/approuter`: affected `<20.10.0`, fixed in `20.10.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Jul 2026 · Tags: HTTP request smuggling
- [Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests](https://agentprime.io/advisories/GHSA-659f-rgp5-w4wf.md)
  `GHSA-659f-rgp5-w4wf`, `CVE-2026-50197`, `GO-2026-5944` · Go `github.com/zalando/skipper`: affected `<0.26.10`, fixed in `0.26.10` · CVSS 7.8 High · Not analysed yet · Published 8 Jul 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in OpenVPN Access Server](https://agentprime.io/advisories/CVE-2025-3110.md)
  `CVE-2025-3110` · CVE record: OpenVPN Access Server · CVSS 6.9 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.](https://agentprime.io/advisories/CVE-2026-11541.md)
  `CVE-2026-11541` · CVE record: IBM CICS Transaction Gateway for Multiplatforms · CVSS 7.4 High · Not analysed yet · Published 30 Jun 2026 · Tags: HTTP request smuggling
- [IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability](https://agentprime.io/advisories/CVE-2026-11806.md)
  `CVE-2026-11806` · CVE record: IBM WebSphere Application Server - Liberty · CVSS 7.2 High · Not analysed yet · Published 30 Jun 2026 · Tags: HTTP request smuggling

Newest: <https://agentprime.io/advisories/tag/request-smuggling.md>
Older: <https://agentprime.io/advisories/tag/request-smuggling.md?cursor=WyIyMDI2LTA2LTMwVDE5OjQzOjE3Ljk0NjAwMFoiLCJDVkUtMjAyNi0xMTgwNiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=request-smuggling&cursor=WyIyMDI2LTA5LTE1VDE5OjIwOjAyLjkwMjAwMFoiLCJDVkUtMjAyNi02OTIxNyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/request-smuggling/?cursor=WyIyMDI2LTA5LTE1VDE5OjIwOjAyLjkwMjAwMFoiLCJDVkUtMjAyNi02OTIxNyJd>. Everything for agents: <https://agentprime.io/llms.txt>.