# HTTP request smuggling.

Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Lenient \`hyper\` header parsing of \`Content-Length\` could allow request smuggling](https://agentprime.io/advisories/GHSA-f3pg-qwvg-p99c.md)
  `GHSA-f3pg-qwvg-p99c`, `CVE-2021-32715`, `RUSTSEC-2021-0078` · crates.io `hyper`: affected `>=0.0.0-0, <0.14.10`, fixed in `0.14.10` · CVSS 3.1 Low · Not analysed yet · Published 7 Jul 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling, content length with invalid charters](https://agentprime.io/advisories/CVE-2021-32565.md)
  `CVE-2021-32565` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Jun 2021 · Tags: HTTP request smuggling
- [Incorrect handling of url fragment leads to cache poisoning](https://agentprime.io/advisories/CVE-2021-27577.md)
  `CVE-2021-27577` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 29 Jun 2021 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin](https://agentprime.io/advisories/GHSA-h395-qcrw-5vmq.md)
  `GHSA-h395-qcrw-5vmq`, `CVE-2020-28483`, `GO-2021-0052`, `SNYK-GOLANG-GITHUBCOMGINGONICGIN-1041736` · Go `github.com/gin-gonic/gin`: affected `<1.7.7`, fixed in `1.7.7` · CVSS 7.1 High · Not analysed yet · Published 23 Jun 2021 · Tags: Other injection, HTTP request smuggling
- [HTTP Request Smuggling in netius](https://agentprime.io/advisories/GHSA-wm2m-xrrp-j74c.md)
  `GHSA-wm2m-xrrp-j74c`, `CVE-2020-7655`, `PYSEC-2020-242`, `SNYK-PYTHON-NETIUS-569141` · PyPI `netius`: affected `<1.17.58`, fixed in `1.17.58` · CVSS 6.1 Medium · Not analysed yet · Published 18 Jun 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in Undertow](https://agentprime.io/advisories/GHSA-qjwc-v72v-fq6r.md)
  `GHSA-qjwc-v72v-fq6r`, `CVE-2021-20220` · Maven `io.undertow:undertow-core`: affected `>=2.1.0, <2.1.6 || <2.0.34`, fixed in `2.1.6`, `2.0.34` · CVSS 4.8 Medium · Not analysed yet · Published 16 Jun 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in goliath](https://agentprime.io/advisories/GHSA-3892-2r52-p65m.md)
  `GHSA-3892-2r52-p65m`, `CVE-2020-7671`, `SNYK-RUBY-GOLIATH-569136` · RubyGems `goliath`: affected `<=1.0.6`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 May 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in reel](https://agentprime.io/advisories/GHSA-x3v4-pxvm-63j8.md)
  `GHSA-x3v4-pxvm-63j8`, `CVE-2020-7659`, `SNYK-RUBY-REEL-569135` · RubyGems `reel`: affected `<=0.6.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 24 May 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in akka-http-core](https://agentprime.io/advisories/GHSA-2w7w-2j92-44hx.md)
  `GHSA-2w7w-2j92-44hx`, `CVE-2021-23339`, `SNYK-JAVA-COMTYPESAFEAKKA-1075043` · Maven `com.typesafe.akka:akka-http-core`: affected `>=10.2.0, <10.2.4 || <10.1.14`, fixed in `10.2.4`, `10.1.14` · CVSS 5.0 Medium · Not analysed yet · Published 10 May 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Undertow](https://agentprime.io/advisories/GHSA-p9w3-gwc2-cr49.md)
  `GHSA-p9w3-gwc2-cr49`, `CVE-2020-10687` · Maven `io.undertow:undertow-core`: affected `<2.2.0.Final`, fixed in `2.2.0.Final` · CVSS 4.8 Medium · Not analysed yet · Published 30 Apr 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Undertow](https://agentprime.io/advisories/GHSA-cccf-7xw3-p2vr.md)
  `GHSA-cccf-7xw3-p2vr`, `CVE-2020-10719` · Maven `io.undertow:undertow-core`: affected `<2.1.1.Final`, fixed in `2.1.1.Final` · CVSS 6.5 Medium · Not analysed yet · Published 30 Apr 2021 · Tags: HTTP request smuggling
- [bottle HTTP Request smuggling](https://agentprime.io/advisories/GHSA-qhx9-7hx7-cp4r.md)
  `GHSA-qhx9-7hx7-cp4r`, `CVE-2020-28473`, `PYSEC-2021-129`, `SNYK-PYTHON-BOTTLE-1017108` · PyPI `bottle`: affected `<0.12.19`, fixed in `0.12.19` · CVSS 6.8 Medium · Not analysed yet · Published 7 Apr 2021 · Tags: HTTP request smuggling
- [Possible request smuggling in HTTP/2 due missing validation of content-length](https://agentprime.io/advisories/GHSA-f256-j965-7f32.md)
  `GHSA-f256-j965-7f32`, `CVE-2021-21409` · Maven `io.netty:netty` and 2 more: affected `*`, no fixed version yet · CVSS 5.9 Medium · Not analysed yet · Published 30 Mar 2021 · Tags: HTTP request smuggling
- [Possible request smuggling in HTTP/2 due missing validation](https://agentprime.io/advisories/GHSA-wm47-8v5p-wjpj.md)
  `GHSA-wm47-8v5p-wjpj`, `BIT-zookeeper-2021-21295`, `CVE-2021-21295` · Maven `io.netty:netty` and 2 more: affected `*`, no fixed version yet · CVSS 5.9 Medium · EPSS 0.19 · Not analysed yet · Published 9 Mar 2021 · Tags: HTTP request smuggling
- [Web Cache Poisoning](https://agentprime.io/advisories/CVE-2021-23336.md)
  `CVE-2021-23336` · CVE record: python/cpython · CVSS 5.9 Medium · EPSS 0.41 · Not analysed yet · Published 15 Feb 2021 · Tags: HTTP request smuggling
- [Multiple Transfer-Encoding headers misinterprets request payload](https://agentprime.io/advisories/GHSA-6hfq-h8hq-87mf.md)
  `GHSA-6hfq-h8hq-87mf`, `CVE-2021-21299`, `RUSTSEC-2021-0020` · crates.io `hyper`: affected `>=0.12.0, <0.12.36 || >=0.13.0-0, <0.13.10 || >=0.14.0-0, <0.14.3`, fixed in `0.12.36`, `0.13.10`, `0.14.3` · CVSS 4.8 Medium · Not analysed yet · Published 5 Feb 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2020-8287.md)
  `CVE-2020-8287` · CVE record: NodeJS Node · No CVSS score · EPSS 0.16 · Not analysed yet · Published 6 Jan 2021 · Tags: HTTP request smuggling
- [Web Cache Poisoning in find-my-way](https://agentprime.io/advisories/GHSA-jgrh-5m3h-9c5f.md)
  `GHSA-jgrh-5m3h-9c5f`, `CVE-2020-7764`, `SNYK-JS-FINDMYWAY-1038269` · npm `find-my-way`: affected `<2.2.5 || >=3.0.0, <3.0.5`, fixed in `2.2.5`, `3.0.5` · CVSS 5.9 Medium · Not analysed yet · Published 9 Nov 2020 · Tags: HTTP request smuggling
- [Withdrawn: HTTP Request Smuggling in Agoo](https://agentprime.io/advisories/GHSA-h385-52j6-9984.md)
  `GHSA-h385-52j6-9984`, `CVE-2020-7670` · RubyGems `agoo`: affected `<=2.13.0`, no fixed version yet · No CVSS score · Withdrawn · Not analysed yet · Published 20 Oct 2020 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2020-8201.md)
  `CVE-2020-8201` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 18 Sept 2020 · Tags: HTTP request smuggling
- [HTTP Smuggling via Transfer-Encoding Header in Puma](https://agentprime.io/advisories/GHSA-w64w-qqph-5gxm.md)
  `GHSA-w64w-qqph-5gxm`, `CVE-2020-11077` · RubyGems `puma`: affected `<3.12.6 || >=4.0.0, <4.3.5`, fixed in `3.12.6`, `4.3.5` · CVSS 6.8 Medium · Not analysed yet · Published 22 May 2020 · Tags: HTTP request smuggling
- [HTTP Smuggling via Transfer-Encoding Header in Puma](https://agentprime.io/advisories/GHSA-x7jg-6pwg-fx5h.md)
  `GHSA-x7jg-6pwg-fx5h`, `CVE-2020-11076` · RubyGems `puma`: affected `<3.12.5 || >=4.0.0, <4.3.4`, fixed in `3.12.5`, `4.3.4` · CVSS 7.5 High · Not analysed yet · Published 22 May 2020 · Tags: HTTP request smuggling
- [Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)](https://agentprime.io/advisories/GHSA-gv3v-92v6-m48j.md)
  `GHSA-gv3v-92v6-m48j`, `CVE-2020-7622`, `SNYK-JAVA-IOJOOBY-564249` · Maven `io.jooby:jooby-netty`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 6.5 Medium · Not analysed yet · Published 3 Apr 2020 · Tags: HTTP request smuggling
- [Improper Input Validation in Twisted](https://agentprime.io/advisories/GHSA-h96w-mmrf-2h6v.md)
  `GHSA-h96w-mmrf-2h6v`, `CVE-2020-10108`, `PYSEC-2020-259` · PyPI `twisted`: affected `<20.3.0`, fixed in `20.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2020 · Tags: HTTP request smuggling, CWE-20
- [HTTP Request Smuggling in Twisted](https://agentprime.io/advisories/GHSA-p5xh-vx83-mxcj.md)
  `GHSA-p5xh-vx83-mxcj`, `CVE-2020-10109`, `PYSEC-2020-260` · PyPI `twisted`: affected `<20.3.0`, fixed in `20.3.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2020 · Tags: HTTP request smuggling
- [Micronaut's HTTP client is vulnerable to HTTP Request Header Injection](https://agentprime.io/advisories/GHSA-694p-xrhg-x3wm.md)
  `GHSA-694p-xrhg-x3wm`, `CVE-2020-7611`, `SNYK-JAVA-IOMICRONAUT-561342` · Maven `io.micronaut:micronaut-http-client`: affected `<1.2.11 || >=1.3.0, <1.3.2`, fixed in `1.2.11`, `1.3.2` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2020 · Tags: HTTP request smuggling
- [Potential HTTP request smuggling in Apache Tomcat](https://agentprime.io/advisories/GHSA-767j-jfh2-jvrc.md)
  `GHSA-767j-jfh2-jvrc`, `CVE-2019-17569` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=7.0.98, <7.0.100 || >=8.5.48, <8.5.51 || >=9.0.28, <9.0.31`, fixed in `7.0.100`, `8.5.51`, `9.0.31` · CVSS 4.8 Medium · Not analysed yet · Published 28 Feb 2020 · Tags: HTTP request smuggling
- [Potential HTTP request smuggling in Apache Tomcat](https://agentprime.io/advisories/GHSA-qxf4-chvg-4r8r.md)
  `GHSA-qxf4-chvg-4r8r`, `BIT-tomcat-2020-1935`, `CVE-2020-1935` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `<7.0.100 || >=8.0.0, <8.5.51 || >=9.0.0, <9.0.31`, fixed in `7.0.100`, `8.5.51`, `9.0.31` · CVSS 4.8 Medium · Not analysed yet · Published 28 Feb 2020 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Netty](https://agentprime.io/advisories/GHSA-ff2w-cq2g-wv5f.md)
  `GHSA-ff2w-cq2g-wv5f`, `CVE-2020-7238` · Maven `io.netty:netty-handler`: affected `>=4.1.43, <4.1.45`, fixed in `4.1.45` · CVSS 7.5 High · Not analysed yet · Published 21 Feb 2020 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Netty](https://agentprime.io/advisories/GHSA-cqqj-4p63-rrmm.md)
  `GHSA-cqqj-4p63-rrmm`, `CVE-2019-20444` · Maven `io.netty:netty` and 2 more: affected `*`, no fixed version yet · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Feb 2020 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Netty](https://agentprime.io/advisories/GHSA-p2v9-g2qv-p635.md)
  `GHSA-p2v9-g2qv-p635`, `CVE-2019-20445` · Maven `io.netty:netty` and 2 more: affected `*`, no fixed version yet · No CVSS score · EPSS 0.14 · Not analysed yet · Published 21 Feb 2020 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2019-15605.md)
  `CVE-2019-15605` · CVE record: NodeJS Node · No CVSS score · EPSS 0.57 · Not analysed yet · Published 7 Feb 2020 · Tags: HTTP request smuggling
- [Ability to expose data in Sylius by using an unintended serialisation group](https://agentprime.io/advisories/GHSA-8vp7-j5cj-vvm2.md)
  `GHSA-8vp7-j5cj-vvm2`, `CVE-2020-5218`, `CVE-2020-5220`, `GHSA-prg5-hg25-8grq`, `PKSA-3b3k-ptfz-1wwy`, `PKSA-bpp9-7wqw-wr8k`, `PKSA-sjsn-7352-ttw3` · Packagist `sylius/resource-bundle` and 1 more: affected `>=1.0.0, <1.3.13 || >=1.4.0, <1.4.6 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.3`, fixed in `1.3.13`, `1.4.6`, `1.5.1`, `1.6.3` · CVSS 4.4 Medium · Not analysed yet · Published 31 Jan 2020 · Tags: Information disclosure, HTTP request smuggling
- [Request smuggling is possible when both chunked TE and content length specified](https://agentprime.io/advisories/GHSA-xrr9-rh8p-433v.md)
  `GHSA-xrr9-rh8p-433v`, `CVE-2020-5207` · Maven `io.ktor:ktor-client-cio` and 1 more: affected `<1.3.0`, fixed in `1.3.0` · CVSS 5.4 Medium · Not analysed yet · Published 27 Jan 2020 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)](https://agentprime.io/advisories/GHSA-968f-66r5-5v74.md)
  `GHSA-968f-66r5-5v74`, `CVE-2019-16789`, `PYSEC-2019-138` · PyPI `waitress`: affected `<1.4.2`, fixed in `1.4.2` · CVSS 7.1 High · Not analysed yet · Published 6 Jan 2020 · Tags: HTTP request smuggling
- [HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress](https://agentprime.io/advisories/GHSA-m5ff-3wj3-8ph4.md)
  `GHSA-m5ff-3wj3-8ph4` · PyPI `waitress`: affected `<1.4.1`, fixed in `1.4.1` · No CVSS score · Not analysed yet · Published 26 Dec 2019 · Tags: HTTP request smuggling
- [HTTP Request Smuggling: Content-Length Sent Twice in Waitress](https://agentprime.io/advisories/GHSA-4ppp-gpcr-7qf6.md)
  `GHSA-4ppp-gpcr-7qf6`, `CVE-2019-16792`, `GHSA-j7j6-7hfx-5522`, `PYSEC-2020-178` · PyPI `waitress`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 7.1 High · Not analysed yet · Published 20 Dec 2019 · Tags: HTTP request smuggling
- [HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress](https://agentprime.io/advisories/GHSA-g2xc-35jw-c63p.md)
  `GHSA-g2xc-35jw-c63p`, `CVE-2019-16786`, `PYSEC-2019-137` · PyPI `waitress`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 7.1 High · Not analysed yet · Published 20 Dec 2019 · Tags: HTTP request smuggling
- [HTTP Request Smuggling: LF vs CRLF handling in Waitress](https://agentprime.io/advisories/GHSA-pg36-wpm5-g57p.md)
  `GHSA-pg36-wpm5-g57p`, `CVE-2019-16785`, `PYSEC-2019-136` · PyPI `waitress`: affected `<1.4.0`, fixed in `1.4.0` · CVSS 7.1 High · Not analysed yet · Published 20 Dec 2019 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Netty](https://agentprime.io/advisories/GHSA-p979-4mfw-53vg.md)
  `GHSA-p979-4mfw-53vg`, `CVE-2019-16869` · Maven `io.netty:netty` and 2 more: affected `>=3.3.0.Final, <=4.0.0.Alpha8`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 11 Oct 2019 · Tags: HTTP request smuggling
- [Parse Server before v3.4.1 vulnerable to Denial of Service](https://agentprime.io/advisories/GHSA-2479-qvv7-47qq.md)
  `GHSA-2479-qvv7-47qq`, `CVE-2019-1020012` · npm `parse-server`: affected `<3.4.1`, fixed in `3.4.1` · CVSS 7.5 High · Not analysed yet · Published 13 Jun 2019 · Tags: HTTP request smuggling
- [Undertow-core vulnerable to HTTP Request Smuggling](https://agentprime.io/advisories/GHSA-mcfm-h73v-635m.md)
  `GHSA-mcfm-h73v-635m`, `CVE-2017-2666` · Maven `io.undertow:undertow-core`: affected `<1.3.31 || >=1.4.0, <1.4.17`, fixed in `1.3.31`, `1.4.17` · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2018 · Tags: HTTP request smuggling
- [Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)](https://agentprime.io/advisories/GHSA-6x9x-8qw9-9pp6.md)
  `GHSA-6x9x-8qw9-9pp6`, `CVE-2017-7658` · Maven `org.eclipse.jetty:jetty-server`: affected `<9.2.25.v20180606 || >=9.3.0, <9.3.24.v20180605 || >=9.4.0, <9.4.11.v20180605`, fixed in `9.2.25.v20180606`, `9.3.24.v20180605`, `9.4.11.v20180605` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.19 · Not analysed yet · Published 19 Oct 2018 · Tags: HTTP request smuggling
- [Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)](https://agentprime.io/advisories/GHSA-84q7-p226-4x5w.md)
  `GHSA-84q7-p226-4x5w`, `CVE-2017-7656` · Maven `org.eclipse.jetty:jetty-server`: affected `<9.3.24.v20180605 || >=9.4.0, <9.4.11.v20180605`, fixed in `9.3.24.v20180605`, `9.4.11.v20180605` · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2018 · Tags: HTTP request smuggling
- [Critical severity vulnerability that affects org.eclipse.jetty:jetty-server](https://agentprime.io/advisories/GHSA-vgg8-72f2-qm23.md)
  `GHSA-vgg8-72f2-qm23`, `CVE-2017-7657` · Maven `org.eclipse.jetty:jetty-server`: affected `<9.2.25.v20180606 || >=9.3.0, <9.3.24.v20180605`, fixed in `9.2.25.v20180606`, `9.3.24.v20180605` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.14 · Not analysed yet · Published 19 Oct 2018 · Tags: Memory corruption, HTTP request smuggling

Newest: <https://agentprime.io/advisories/tag/request-smuggling.md>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=request-smuggling&cursor=WyIyMDIxLTA3LTE0VDExOjA0OjQ1LjAwMDAwMFoiLCJDVkUtMjAyMS0zMzY4MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/request-smuggling/?cursor=WyIyMDIxLTA3LTE0VDExOjA0OjQ1LjAwMDAwMFoiLCJDVkUtMjAyMS0zMzY4MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.