# HTTP request smuggling.

Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Pingora vulnerable to HTTP Request Smuggling via Premature Upgrade](https://agentprime.io/advisories/GHSA-xq2h-p299-vjwv.md)
  `GHSA-xq2h-p299-vjwv`, `CVE-2026-2833`, `RUSTSEC-2026-0033` · crates.io `pingora-core`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Mar 2026 · Tags: HTTP request smuggling
- [Duplicate Advisory: HTTP Request Smuggling via Premature Upgrade](https://agentprime.io/advisories/GHSA-f9v3-j2m7-4hpg.md)
  `GHSA-f9v3-j2m7-4hpg` · crates.io `pingora-core`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 5 Mar 2026 · Tags: HTTP request smuggling
- [Duplicate Advisory: HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing](https://agentprime.io/advisories/GHSA-262p-vjx5-45xh.md)
  `GHSA-262p-vjx5-45xh` · crates.io `pingora-core`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 5 Mar 2026 · Tags: HTTP request smuggling
- [Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling Vulnerability](https://agentprime.io/advisories/CVE-2026-20069.md)
  `CVE-2026-20069` · CVE record: Cisco Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 4 Mar 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in Akamai Ghost](https://agentprime.io/advisories/CVE-2026-26365.md)
  `CVE-2026-26365` · CVE record: Akamai Ghost · CVSS 4.0 Medium · Not analysed yet · Published 23 Feb 2026 · Tags: HTTP request smuggling
- [Cloud Suite and Privilege Access Service– HTTP request smuggling vulnerability](https://agentprime.io/advisories/CVE-2025-12811.md)
  `CVE-2025-12811` · CVE record: Delinea Inc. Cloud Suite and Privileged Access Service · CVSS 6.9 Medium · Not analysed yet · Published 18 Feb 2026 · Tags: HTTP request smuggling
- [HTTP request smuggling in Fortinet FortiOS](https://agentprime.io/advisories/CVE-2025-55018.md)
  `CVE-2025-55018` · CVE record: Fortinet FortiOS · CVSS 5.2 Medium · Not analysed yet · Published 10 Feb 2026 · Tags: HTTP request smuggling
- [Libsoup: libsoup: http request smuggling via malformed chunk headers](https://agentprime.io/advisories/CVE-2026-1801.md)
  `CVE-2026-1801` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 3 Feb 2026 · Tags: HTTP request smuggling
- [Libsoup: soupserver: denial of service via http request smuggling](https://agentprime.io/advisories/CVE-2026-1760.md)
  `CVE-2026-1760` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.3 Medium · Not analysed yet · Published 2 Feb 2026 · Tags: HTTP request smuggling
- [HTTP Request/Response Smuggling in Altitude Communication Server](https://agentprime.io/advisories/CVE-2025-41082.md)
  `CVE-2025-41082` · CVE record: Altitude Altitude Communication Server · CVSS 6.9 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: HTTP request smuggling
- [Vert.x Web static handler component cache can be manipulated to deny the access to static files](https://agentprime.io/advisories/GHSA-cphf-4846-3xx9.md)
  `GHSA-cphf-4846-3xx9`, `CVE-2026-1002` · Maven `io.vertx:vertx-core`: affected `<4.5.24 || >=5.0.0.CR1, <5.0.7`, fixed in `4.5.24`, `5.0.7` · CVSS 6.9 Medium · Not analysed yet · Published 15 Jan 2026 · Tags: HTTP request smuggling
- [h3 v1 has Request Smuggling (TE.TE) issue](https://agentprime.io/advisories/GHSA-mp2g-9vg9-f4cg.md)
  `GHSA-mp2g-9vg9-f4cg`, `CVE-2026-23527` · npm `h3`: affected `<1.15.5`, fixed in `1.15.5` · CVSS 8.9 High · Not analysed yet · Published 15 Jan 2026 · Tags: HTTP request smuggling
- [AIOHTTP has unicode match groups in regexes for ASCII protocol elements](https://agentprime.io/advisories/GHSA-mqqc-3gqh-h2x8.md)
  `GHSA-mqqc-3gqh-h2x8`, `CVE-2025-69225`, `PYSEC-2026-1109` · PyPI `aiohttp`: affected `<3.13.3`, fixed in `3.13.3` · CVSS 2.7 Low · Not analysed yet · Published 5 Jan 2026 · Tags: HTTP request smuggling
- [AIOHTTP's unicode processing of header values could cause parsing discrepancies](https://agentprime.io/advisories/GHSA-69f9-5gxw-wvc2.md)
  `GHSA-69f9-5gxw-wvc2`, `CVE-2025-69224`, `PYSEC-2026-1099` · PyPI `aiohttp`: affected `<3.13.3`, fixed in `3.13.3` · CVSS 6.3 Medium · Not analysed yet · Published 5 Jan 2026 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Quest Coexistence Manager for Notes](https://agentprime.io/advisories/CVE-2025-12874.md)
  `CVE-2025-12874` · CVE record: Quest Coexistence Manager for Notes · CVSS 6.3 Medium · Not analysed yet · Published 19 Dec 2025 · Tags: HTTP request smuggling
- [Member Login Script 3.3 Client-Side Request Desynchronization Vulnerability](https://agentprime.io/advisories/CVE-2023-53878.md)
  `CVE-2023-53878` · CVE record: Phpjabbers Member Login Script · CVSS 6.9 Medium · Not analysed yet · Published 15 Dec 2025 · Tags: HTTP request smuggling
- [Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins)](https://agentprime.io/advisories/CVE-2025-14523.md)
  `CVE-2025-14523` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 8.2 High · Not analysed yet · Published 11 Dec 2025 · Tags: HTTP request smuggling
- [Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length.](https://agentprime.io/advisories/CVE-2025-61258.md)
  `CVE-2025-61258` · CVE record · CVSS 7.5 High · Not analysed yet · Published 9 Dec 2025 · Tags: HTTP request smuggling
- [Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling.](https://agentprime.io/advisories/CVE-2025-66373.md)
  `CVE-2025-66373` · CVE record · CVSS 4.8 Medium · Not analysed yet · Published 4 Dec 2025 · Tags: HTTP request smuggling
- [HTTP Header Smuggling via Trailer Merge](https://agentprime.io/advisories/CVE-2025-12642.md)
  `CVE-2025-12642` · CVE record: lighttpd lighttpd · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2025 · Tags: HTTP request smuggling
- [Hono vulnerable to Vary Header Injection leading to potential CORS Bypass](https://agentprime.io/advisories/GHSA-q7jf-gf43-6x6p.md)
  `GHSA-q7jf-gf43-6x6p`, `CVE-2025-71381` · npm `hono`: affected `<4.10.3`, fixed in `4.10.3` · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2025 · Tags: Other injection, HTTP request smuggling
- [HTTP Desynchronisation in Vertex AI for certain third-party models](https://agentprime.io/advisories/CVE-2025-11915.md)
  `CVE-2025-11915` · CVE record: Google Cloud Vertex AI: Partner Models for MaaS and 2 more · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: HTTP request smuggling
- [Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability](https://agentprime.io/advisories/GHSA-5rrx-jjjq-q2r5.md)
  `GHSA-5rrx-jjjq-q2r5`, `BIT-aspnet-core-2025-55315`, `CVE-2025-55315` · NuGet `Microsoft.AspNetCore.App.Runtime.linux-arm` and 12 more: affected `>=8.0.0, <8.0.21 || >=9.0.0, <9.0.10 || >=10.0.0-rc.1.25451.107, <10.0.0-rc.2.25502.107`, fixed in `8.0.21`, `9.0.10`, `10.0.0-rc.2.25502.107` · CVSS 9.9 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.67 · Not analysed yet · Published 14 Oct 2025 · Tags: HTTP request smuggling
- [Server-side request forgery in Oracle Corporation Oracle Configurator](https://agentprime.io/advisories/CVE-2025-61884.md)
  `CVE-2025-61884` · CVE record: Oracle Corporation Oracle Configurator · CVSS 7.5 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV, ransomware · EPSS 0.96 · Not analysed yet · Published 12 Oct 2025 · Tags: Path traversal, Other injection, Authentication bypass, HTTP request smuggling
- [Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section](https://agentprime.io/advisories/GHSA-wcwh-7gfw-5wrr.md)
  `GHSA-wcwh-7gfw-5wrr`, `CVE-2025-59822` · Maven `org.http4s:http4s-ember-core_2.12` and 2 more: affected `<0.23.31`, fixed in `0.23.31` · CVSS 6.3 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: HTTP request smuggling
- [WatchGuard Firebox Authentication Portal Request Smuggling Vulnerability](https://agentprime.io/advisories/CVE-2025-6999.md)
  `CVE-2025-6999` · CVE record: WatchGuard Fireware OS · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2025 · Tags: HTTP request smuggling
- [A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.](https://agentprime.io/advisories/CVE-2025-56266.md)
  `CVE-2025-56266` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Sept 2025 · Tags: Other injection, HTTP request smuggling, CWE-116
- [Netty vulnerable to request smuggling due to incorrect parsing of chunk extensions](https://agentprime.io/advisories/GHSA-fghv-69vj-qj49.md)
  `GHSA-fghv-69vj-qj49`, `CVE-2025-58056` · Maven `io.netty:netty-codec-http`: affected `<4.1.125.Final || >=4.2.0.Alpha1, <4.2.5.Final`, fixed in `4.1.125.Final`, `4.2.5.Final` · CVSS 2.9 Low · Not analysed yet · Published 4 Sept 2025 · Tags: HTTP request smuggling
- [Eventlet affected by HTTP request smuggling in unparsed trailers](https://agentprime.io/advisories/GHSA-hw6f-rjfj-j7j7.md)
  `GHSA-hw6f-rjfj-j7j7`, `CVE-2025-58068`, `PYSEC-2026-1350` · PyPI `eventlet`: affected `<0.40.3`, fixed in `0.40.3` · CVSS 6.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: HTTP request smuggling
- [HTTP request smuggling in AkamaiGhost](https://agentprime.io/advisories/CVE-2025-54142.md)
  `CVE-2025-54142` · CVE record: Akamai AkamaiGhost · CVSS 4.0 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: HTTP request smuggling
- [mitmproxy binaries embed a vulnerable python-hyper/h2 dependency](https://agentprime.io/advisories/GHSA-63cx-g855-hvv4.md)
  `GHSA-63cx-g855-hvv4` · PyPI `mitmproxy`: affected `<12.1.2`, fixed in `12.1.2` · CVSS 4.0, no score published · Not analysed yet · Published 25 Aug 2025 · Tags: HTTP request smuggling, CWE-1395
- [HTTP request smuggling in AkamaiGhost](https://agentprime.io/advisories/CVE-2025-32094.md)
  `CVE-2025-32094` · CVE record: Akamai AkamaiGhost · CVSS 4.0 Medium · Not analysed yet · Published 7 Aug 2025 · Tags: HTTP request smuggling
- [EspoCRM is vulnerable to access denial through double slash in URI corrupting router cache](https://agentprime.io/advisories/CVE-2025-52892.md)
  `CVE-2025-52892` · CVE record: espocrm espocrm · CVSS 4.5 Medium · Not analysed yet · Published 5 Aug 2025 · Tags: HTTP request smuggling
- [AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections](https://agentprime.io/advisories/GHSA-9548-qrrj-x5pj.md)
  `GHSA-9548-qrrj-x5pj`, `CVE-2025-53643`, `PYSEC-2026-1104` · PyPI `aiohttp`: affected `<3.12.14`, fixed in `3.12.14` · CVSS 1.7 Low · Not analysed yet · Published 14 Jul 2025 · Tags: HTTP request smuggling
- [Next.JS vulnerability can lead to DoS via cache poisoning](https://agentprime.io/advisories/GHSA-67rr-84xm-4c7r.md)
  `GHSA-67rr-84xm-4c7r`, `CVE-2025-49826` · npm `next`: affected `>=15.0.4-canary.51, <15.1.8`, fixed in `15.1.8` · CVSS 7.5 High · Not analysed yet · Published 3 Jul 2025 · Tags: HTTP request smuggling
- [Next.js has a Cache poisoning vulnerability due to omission of the Vary header](https://agentprime.io/advisories/GHSA-r2fc-ccr8-96c4.md)
  `GHSA-r2fc-ccr8-96c4`, `CVE-2025-49005` · npm `next`: affected `>=15.3.0, <15.3.3`, fixed in `15.3.3` · CVSS 3.7 Low · Not analysed yet · Published 3 Jul 2025 · Tags: HTTP request smuggling
- [Ruby WEBrick read_headers method can lead to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-r995-q44h-hr64.md)
  `GHSA-r995-q44h-hr64`, `CVE-2025-6442` · RubyGems `webrick`: affected `<1.8.2`, fixed in `1.8.2` · CVSS 6.5 Medium · Not analysed yet · Published 26 Jun 2025 · Tags: HTTP request smuggling
- [Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies](https://agentprime.io/advisories/GHSA-6j2q-c73v-97c5.md)
  `GHSA-6j2q-c73v-97c5`, `CVE-2025-41235` · Maven `org.springframework.cloud:spring-cloud-gateway-server` and 1 more: affected `>=4.2.0, <4.2.3 || >=4.1.0, <4.1.8 || >=4.0.0, <=4.0.9 || <3.1.10`, fixed in `4.2.3`, `4.1.8`, `3.1.10` · CVSS 8.6 High · Not analysed yet · Published 30 May 2025 · Tags: HTTP request smuggling
- [Duplicate Advisory: Pingora Request Smuggling and Cache Poisoning](https://agentprime.io/advisories/GHSA-3qmp-g57h-rxf2.md)
  `GHSA-3qmp-g57h-rxf2` · crates.io `pingora-core`: affected `<0.5.0`, fixed in `0.5.0` · CVSS 4.0, no score published · Withdrawn · Not analysed yet · Published 22 May 2025 · Tags: HTTP request smuggling
- [Pingora Request Smuggling and Cache Poisoning](https://agentprime.io/advisories/GHSA-93c7-7xqw-w357.md)
  `GHSA-93c7-7xqw-w357`, `CVE-2025-4366`, `RUSTSEC-2025-0037` · crates.io `pingora-core`: affected `>=0.0.0-0, <0.5.0`, fixed in `0.5.0` · CVSS 7.4 High · Not analysed yet · Published 22 May 2025 · Tags: HTTP request smuggling
- [HTTP request smuggling in node](https://agentprime.io/advisories/CVE-2025-23167.md)
  `CVE-2025-23167` · CVE record: nodejs node · CVSS 6.5 Medium · Not analysed yet · Published 19 May 2025 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding Validation](https://agentprime.io/advisories/CVE-2025-4600.md)
  `CVE-2025-4600` · CVE record: Google Cloud Classic Application Load Balancer · CVSS 8.7 High · Not analysed yet · Published 16 May 2025 · Tags: HTTP request smuggling
- [HTTP request smuggling in varnish-software Varnish Cache](https://agentprime.io/advisories/CVE-2025-47905.md)
  `CVE-2025-47905` · CVE record: varnish-software Varnish Cache · CVSS 5.4 Medium · Not analysed yet · Published 13 May 2025 · Tags: HTTP request smuggling
- [Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request body when using the HTTP GET method.](https://agentprime.io/advisories/CVE-2024-56523.md)
  `CVE-2024-56523` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2025 · Tags: HTTP request smuggling
- [h11 accepts some malformed Chunked-Encoding bodies](https://agentprime.io/advisories/GHSA-vqfr-h8mv-ghfj.md)
  `GHSA-vqfr-h8mv-ghfj`, `CVE-2025-43859`, `PYSEC-2026-348` · PyPI `h11`: affected `<0.16.0`, fixed in `0.16.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Apr 2025 · Tags: HTTP request smuggling
- [An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.](https://agentprime.io/advisories/CVE-2024-33452.md)
  `CVE-2024-33452` · CVE record · CVSS 7.7 High · Not analysed yet · Published 22 Apr 2025 · Tags: HTTP request smuggling
- [croogo Host header injection](https://agentprime.io/advisories/GHSA-847x-x4jg-6gf4.md)
  `GHSA-847x-x4jg-6gf4`, `CVE-2024-29643`, `PKSA-m7fq-4r5b-c4ty` · Packagist `croogo/croogo`: affected `<=3.0.2`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Apr 2025 · Tags: Other injection, HTTP request smuggling
- [CVE-2025-1386- Query smuggling in ch-go library](https://agentprime.io/advisories/GHSA-m454-3xv7-qj85.md)
  `GHSA-m454-3xv7-qj85`, `CVE-2025-1386`, `GO-2025-3603` · Go `github.com/ClickHouse/ch-go`: affected `<0.65.0`, fixed in `0.65.0` · CVSS 5.9 Medium · Not analysed yet · Published 12 Apr 2025 · Tags: HTTP request smuggling
- [RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency](https://agentprime.io/advisories/GHSA-g9pc-8g42-g6vq.md)
  `GHSA-g9pc-8g42-g6vq`, `BIT-golang-2025-22871`, `CVE-2025-22871`, `GO-2025-3563`, `PKSA-xbp4-qwr2-cbjj` · Packagist `spiral/roadrunner`: affected `<2025.1.0`, fixed in `2025.1.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Apr 2025 · Tags: HTTP request smuggling, CWE-1395
- [Apache Traffic Server: Malformed chunked message body allows request smuggling](https://agentprime.io/advisories/CVE-2024-53868.md)
  `CVE-2024-53868` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.5 High · Not analysed yet · Published 3 Apr 2025 · Tags: HTTP request smuggling
- [Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headers](https://agentprime.io/advisories/GHSA-4q56-crqp-v477.md)
  `GHSA-4q56-crqp-v477`, `CVE-2025-31137` · npm `@react-router/express` and 1 more: affected `>=7.0.0, <7.4.1`, fixed in `7.4.1` · CVSS 7.5 High · Not analysed yet · Published 1 Apr 2025 · Tags: HTTP request smuggling
- [IBM Cognos Controller HTTP response smuggling](https://agentprime.io/advisories/CVE-2022-39163.md)
  `CVE-2022-39163` · CVE record: IBM Cognos Controller and 1 more · CVSS 4.7 Medium · Not analysed yet · Published 26 Mar 2025 · Tags: HTTP request smuggling
- [HTTP request smuggling in varnish-software Varnish Cache](https://agentprime.io/advisories/CVE-2025-30346.md)
  `CVE-2025-30346` · CVE record: varnish-software Varnish Cache · CVSS 5.4 Medium · Not analysed yet · Published 21 Mar 2025 · Tags: HTTP request smuggling
- [Gunicorn HTTP Request/Response Smuggling vulnerability](https://agentprime.io/advisories/GHSA-hc5x-x2vx-497g.md)
  `GHSA-hc5x-x2vx-497g`, `CVE-2024-6827`, `PYSEC-2026-1433` · PyPI `gunicorn`: affected `<22.0.0`, fixed in `22.0.0` · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in netease-youdao/qanything](https://agentprime.io/advisories/CVE-2024-10264.md)
  `CVE-2024-10264` · CVE record: netease-youdao netease-youdao/qanything · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: HTTP request smuggling
- [HTTP request smuggling in JetBrains Ktor](https://agentprime.io/advisories/CVE-2025-29904.md)
  `CVE-2025-29904` · CVE record: JetBrains Ktor · CVSS 5.3 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: HTTP request smuggling
- [HTTP Response Smuggling Vulnerability in libhv](https://agentprime.io/advisories/CVE-2025-1867.md)
  `CVE-2025-1867` · CVE record: ithewei libhv · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2025 · Tags: HTTP request smuggling
- [In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint.](https://agentprime.io/advisories/CVE-2024-56908.md)
  `CVE-2024-56908` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 13 Feb 2025 · Tags: HTTP request smuggling, CWE-1287
- [Envoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized access](https://agentprime.io/advisories/CVE-2025-0752.md)
  `CVE-2025-0752` · CVE record: Red Hat OpenShift Service Mesh 2 · CVSS 7.1 High · Not analysed yet · Published 28 Jan 2025 · Tags: HTTP request smuggling
- [In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests.](https://agentprime.io/advisories/CVE-2023-29476.md)
  `CVE-2023-29476` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Dec 2024 · Tags: HTTP request smuggling

Newest: <https://agentprime.io/advisories/tag/request-smuggling.md>
Older: <https://agentprime.io/advisories/tag/request-smuggling.md?cursor=WyIyMDI0LTEyLTE0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yOTQ3NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=request-smuggling&cursor=WyIyMDI2LTAzLTA1VDIwOjU2OjIwLjAwMDAwMFoiLCJHSFNBLWhqN3gtODc5dy12cnA3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/request-smuggling/?cursor=WyIyMDI2LTAzLTA1VDIwOjU2OjIwLjAwMDAwMFoiLCJHSFNBLWhqN3gtODc5dy12cnA3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.