# HTTP request smuggling.

Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser](https://agentprime.io/advisories/GHSA-45c4-8wx5-qw6w.md)
  `GHSA-45c4-8wx5-qw6w`, `CVE-2023-37276`, `PYSEC-2023-120` · PyPI `aiohttp`: affected `<3.8.5`, fixed in `3.8.5` · CVSS 5.3 Medium · Not analysed yet · Published 20 Jul 2023 · Tags: HTTP request smuggling
- [Request smuggling and request concatenation in SAP Web Dispatcher](https://agentprime.io/advisories/CVE-2023-33987.md)
  `CVE-2023-33987` · CVE record: SAP_SE SAP Web Dispatcher · CVSS 8.6 High · Not analysed yet · Published 11 Jul 2023 · Tags: HTTP request smuggling
- [Emby Server Proxy Header Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2023-33193.md)
  `CVE-2023-33193` · CVE record: EmbySupport security · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 May 2023 · Tags: HTTP request smuggling
- [LavaLite vulnerable to web cache poisoning](https://agentprime.io/advisories/GHSA-6vcf-cfjp-qxcw.md)
  `GHSA-6vcf-cfjp-qxcw`, `CVE-2023-27238`, `PKSA-zzjm-3hfj-k9w1` · Packagist `lavalite/cms`: affected `<=9.0.0`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2023 · Tags: HTTP request smuggling
- [HTTP request smuggling in HAProxy](https://agentprime.io/advisories/CVE-2023-25950.md)
  `CVE-2023-25950` · CVE record: HAProxy Technologies HAProxy · CVSS 7.3 High · Not analysed yet · Published 11 Apr 2023 · Tags: HTTP request smuggling
- [X-Forwarded-For header allows brute-forcing autoblocked IP addresses](https://agentprime.io/advisories/GHSA-5vj8-g3qg-4qh6.md)
  `GHSA-5vj8-g3qg-4qh6`, `BIT-mediawiki-2023-29141`, `CVE-2023-29141`, `PKSA-sywz-vkhh-67ff` · Packagist `mediawiki/core`: affected `<1.35.10 || >=1.38.0, <1.38.6 || >=1.39.0, <1.39.3`, fixed in `1.35.10`, `1.38.6`, `1.39.3` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Mar 2023 · Tags: HTTP request smuggling
- [Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling](https://agentprime.io/advisories/GHSA-vcph-37mh-fqrh.md)
  `GHSA-vcph-37mh-fqrh`, `BIT-apache-2023-27522`, `CVE-2023-27522`, `PYSEC-2026-1058` · PyPI `uwsgi`: affected `<2.0.22`, fixed in `2.0.22` · CVSS 7.5 High · Not analysed yet · Published 7 Mar 2023 · Tags: HTTP request smuggling
- [Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy](https://agentprime.io/advisories/CVE-2023-25690.md)
  `CVE-2023-25690` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.85 · Not analysed yet · Published 7 Mar 2023 · Tags: HTTP request smuggling
- [HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP header parsers in HAProxy may accept empt…](https://agentprime.io/advisories/CVE-2023-25725.md)
  `CVE-2023-25725` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Feb 2023 · Tags: HTTP request smuggling
- [HTTP request smuggling in Dell PowerVault ME5](https://agentprime.io/advisories/CVE-2023-23691.md)
  `CVE-2023-23691` · CVE record: Dell Dell PowerVault ME5 · CVSS 8.1 High · Not analysed yet · Published 20 Jan 2023 · Tags: HTTP request smuggling
- [Apache HTTP Server: mod_proxy_ajp Possible request smuggling](https://agentprime.io/advisories/CVE-2022-36760.md)
  `CVE-2022-36760` · CVE record: Apache Software Foundation Apache HTTP Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Jan 2023 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2022-35256.md)
  `CVE-2022-35256` · CVE record: NodeJS Node · CVSS 6.5 Medium · Not analysed yet · Published 5 Dec 2022 · Tags: HTTP request smuggling
- [Client-Side Desync Vulnerability](https://agentprime.io/advisories/CVE-2022-38114.md)
  `CVE-2022-38114` · CVE record: SolarWinds SolarWinds SEM · CVSS 6.1 Medium · Not analysed yet · Published 23 Nov 2022 · Tags: Cross-site scripting (XSS), HTTP request smuggling
- [An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1.](https://agentprime.io/advisories/CVE-2022-45059.md)
  `CVE-2022-45059` · CVE record · CVSS 7.5 High · Not analysed yet · Published 9 Nov 2022 · Tags: HTTP request smuggling
- [Apache Tomcat may reject request containing invalid Content-Length header](https://agentprime.io/advisories/GHSA-p22x-g9px-3945.md)
  `GHSA-p22x-g9px-3945`, `BIT-tomcat-2022-42252`, `CVE-2022-42252` · Maven `org.apache.tomcat.embed:tomcat-embed-core` and 1 more: affected `>=8.5.0, <8.5.83 || >=9.0.0-M1, <9.0.68 || >=10.0.0-M1, <10.0.27 || >=10.1.0-M1, <10.1.1`, fixed in `8.5.83`, `9.0.68`, `10.0.27`, `10.1.1` · CVSS 7.5 High · Not analysed yet · Published 1 Nov 2022 · Tags: HTTP request smuggling, CWE-20
- [HTTP request smuggling in Pulse Connect Secure VPN Server](https://agentprime.io/advisories/CVE-2022-21826.md)
  `CVE-2022-21826` · CVE record: Pulse Connect Secure VPN Server · No CVSS score · EPSS 0.46 · Not analysed yet · Published 30 Sept 2022 · Tags: HTTP request smuggling
- [Quarkus does not terminate HTTP requests header context](https://agentprime.io/advisories/GHSA-mwhw-6p27-4crc.md)
  `GHSA-mwhw-6p27-4crc`, `CVE-2022-2466` · Maven `io.quarkus:quarkus-core-parent`: affected `>=2.10.0, <2.10.4`, fixed in `2.10.4` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Sept 2022 · Tags: HTTP request smuggling
- [HTTP request smuggling in Cisco Adaptive Security Appliance (ASA) Software and others](https://agentprime.io/advisories/CVE-2022-20713.md)
  `CVE-2022-20713` · CVE record: Cisco Cisco Adaptive Security Appliance (ASA) Software and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 10 Aug 2022 · Tags: HTTP request smuggling
- [Improper input validation on HTTP/2 headers](https://agentprime.io/advisories/CVE-2022-25763.md)
  `CVE-2022-25763` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 6.8 Medium · Not analysed yet · Published 10 Aug 2022 · Tags: HTTP request smuggling
- [Diactoros before 2.11.1 vulnerable to HTTP Host Header Attack](https://agentprime.io/advisories/GHSA-8274-h5jp-97vr.md)
  `GHSA-8274-h5jp-97vr`, `CVE-2022-31109`, `PKSA-wdyb-c3m7-9v88` · Packagist `laminas/laminas-diactoros`: affected `<2.11.1`, fixed in `2.11.1` · CVSS 7.2 High · Not analysed yet · Published 27 Jul 2022 · Tags: Cross-site scripting (XSS), HTTP request smuggling
- [llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields](https://agentprime.io/advisories/GHSA-q5vx-44v4-gch4.md)
  `GHSA-q5vx-44v4-gch4`, `BIT-node-2022-32214`, `BIT-node-min-2022-32214`, `CVE-2022-32214` · npm `llhttp`: affected `<6.0.7`, fixed in `6.0.7` · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 15 Jul 2022 · Tags: HTTP request smuggling
- [llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding](https://agentprime.io/advisories/GHSA-5689-v88g-g6rv.md)
  `GHSA-5689-v88g-g6rv`, `BIT-node-2022-32213`, `BIT-node-min-2022-32213`, `CVE-2022-32213` · npm `llhttp`: affected `<6.0.7`, fixed in `6.0.7` · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.45 · Not analysed yet · Published 15 Jul 2022 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2022-32215.md)
  `CVE-2022-32215` · CVE record: NodeJS Node · No CVSS score · EPSS 0.70 · Not analysed yet · Published 14 Jul 2022 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon](https://agentprime.io/advisories/CVE-2022-31081.md)
  `CVE-2022-31081` · CVE record: libwww-perl HTTP-Daemon · CVSS 7.3 High · Not analysed yet · Published 27 Jun 2022 · Tags: HTTP request smuggling
- [mod_proxy_ajp: Possible request smuggling](https://agentprime.io/advisories/CVE-2022-26377.md)
  `CVE-2022-26377` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.21 · Not analysed yet · Published 8 Jun 2022 · Tags: HTTP request smuggling
- [WEBRick vulnerable to HTTP Request/Response Smuggling](https://agentprime.io/advisories/GHSA-gwfg-cqmg-cf8f.md)
  `GHSA-gwfg-cqmg-cf8f`, `BIT-ruby-2020-25613`, `BIT-ruby-min-2020-25613`, `CVE-2020-25613` · RubyGems `webrick`: affected `<1.4.4 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.1`, fixed in `1.4.4`, `1.5.1`, `1.6.1` · CVSS 7.5 High · Not analysed yet · Published 24 May 2022 · Tags: HTTP request smuggling
- [SilverStripe Web Cache Poisoning through HTTPRequestBuilder](https://agentprime.io/advisories/GHSA-q9ff-3q93-fm8m.md)
  `GHSA-q9ff-3q93-fm8m`, `CVE-2019-19326`, `PKSA-75gp-x5bj-hcwc` · Packagist `silverstripe/framework`: affected `>=3.0.0, <3.7.5 || >=4.0.0, <4.4.7 || >=4.5.0, <4.5.4`, fixed in `3.7.5`, `4.4.7`, `4.5.4` · CVSS 5.9 Medium · Not analysed yet · Published 24 May 2022 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP](https://agentprime.io/advisories/GHSA-57q5-x8jf-g7h8.md)
  `GHSA-57q5-x8jf-g7h8`, `CVE-2017-7561` · Maven `org.jboss.resteasy:resteasy-jaxrs`: affected `>=3.0.7.Final, <3.0.25.Final || >=3.1.4.Final, <3.5.0.CR1`, fixed in `3.0.25.Final`, `3.5.0.CR1` · CVSS 7.5 High · Not analysed yet · Published 13 May 2022 · Tags: HTTP request smuggling, CWE-346
- [Keycloak Reflected XSS](https://agentprime.io/advisories/GHSA-v38p-mqq3-m6v5.md)
  `GHSA-v38p-mqq3-m6v5`, `CVE-2017-12158` · Maven `org.keycloak:keycloak-parent`: affected `<3.4.0`, fixed in `3.4.0` · CVSS 5.4 Medium · Not analysed yet · Published 13 May 2022 · Tags: Cross-site scripting (XSS), HTTP request smuggling
- [Undertow Request Smuggling vulnerability](https://agentprime.io/advisories/GHSA-5gg7-5wv8-4gcj.md)
  `GHSA-5gg7-5wv8-4gcj`, `CVE-2017-12165` · Maven `io.undertow:undertow-core`: affected `<1.3.31 || >=1.4.0, <1.4.17 || >=2.0.0.Alpha1, <2.0.0.Beta1`, fixed in `1.3.31`, `1.4.17`, `2.0.0.Beta1` · CVSS 2.6 Low · Not analysed yet · Published 13 May 2022 · Tags: HTTP request smuggling
- [Undertow vulnerable to Request Smuggling](https://agentprime.io/advisories/GHSA-rj76-h87p-r3wf.md)
  `GHSA-rj76-h87p-r3wf`, `CVE-2017-7559` · Maven `io.undertow:undertow-core`: affected `>=1.4.0, <1.4.17.Final || >=1.3.0, <1.3.31.Final || >=2.0.0.Alpha1, <2.0.0.Alpha2`, fixed in `1.4.17.Final`, `1.3.31.Final`, `2.0.0.Alpha2` · CVSS 6.1 Medium · Not analysed yet · Published 13 May 2022 · Tags: HTTP request smuggling
- [HTTP request smuggling in origin-aggregated-logging/elasticsearch](https://agentprime.io/advisories/CVE-2022-0552.md)
  `CVE-2022-0552` · CVE record: origin-aggregated-logging/elasticsearch · No CVSS score · Not analysed yet · Published 11 Apr 2022 · Tags: HTTP request smuggling
- [Inconsistent Interpretation of HTTP Requests in twisted.web](https://agentprime.io/advisories/GHSA-c2jg-hw38-jrqq.md)
  `GHSA-c2jg-hw38-jrqq`, `CVE-2022-24801`, `PYSEC-2022-195` · PyPI `twisted`: affected `<22.4.0`, fixed in `22.4.0` · CVSS 8.1 High · Not analysed yet · Published 4 Apr 2022 · Tags: HTTP request smuggling
- [Puma vulnerable to HTTP Request Smuggling](https://agentprime.io/advisories/GHSA-h99w-9q5r-gjq9.md)
  `GHSA-h99w-9q5r-gjq9`, `CVE-2022-24790` · RubyGems `puma`: affected `<4.3.12 || >=5.0.0, <5.6.4`, fixed in `4.3.12`, `5.6.4` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Mar 2022 · Tags: HTTP request smuggling
- [Insufficient Protection against HTTP Request Smuggling in mitmproxy](https://agentprime.io/advisories/GHSA-gcx2-gvj7-pxv3.md)
  `GHSA-gcx2-gvj7-pxv3`, `CVE-2022-24766`, `PYSEC-2022-170` · PyPI `mitmproxy`: affected `<8.0.0`, fixed in `8.0.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Mar 2022 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in waitress](https://agentprime.io/advisories/GHSA-4f7p-27jc-3c36.md)
  `GHSA-4f7p-27jc-3c36`, `CVE-2022-24761`, `PYSEC-2022-169` · PyPI `waitress`: affected `<2.1.1`, fixed in `2.1.1` · CVSS 7.5 High · Not analysed yet · Published 18 Mar 2022 · Tags: HTTP request smuggling
- [Code injection in Apache Dubbo](https://agentprime.io/advisories/GHSA-7wfc-x4f7-gg2x.md)
  `GHSA-7wfc-x4f7-gg2x`, `CVE-2021-30180` · Maven `org.apache.dubbo:dubbo`: affected `>=2.7.0, <2.7.10`, fixed in `2.7.10` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.60 · Not analysed yet · Published 18 Mar 2022 · Tags: Code injection, HTTP request smuggling
- [HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier](https://agentprime.io/advisories/CVE-2022-22720.md)
  `CVE-2022-22720` · CVE record: Apache Software Foundation Apache HTTP Server · No CVSS score · EPSS 0.28 · Not analysed yet · Published 14 Mar 2022 · Tags: HTTP request smuggling
- [HTTP request smuggling in SAP SE SAP NetWeaver and ABAP Platform and others](https://agentprime.io/advisories/CVE-2022-22536.md)
  `CVE-2022-22536` · CVE record: SAP SE SAP NetWeaver and ABAP Platform and 2 more · CVSS 9.8 Critical · Critical (KEV, CVSS 9+, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.98 · Not analysed yet · Published 9 Feb 2022 · Tags: HTTP request smuggling
- [HTTP request smuggling in SAP SE SAP NetWeaver Application Server Java](https://agentprime.io/advisories/CVE-2022-22532.md)
  `CVE-2022-22532` · CVE record: SAP SE SAP NetWeaver Application Server Java · No CVSS score · Not analysed yet · Published 9 Feb 2022 · Tags: HTTP request smuggling
- [Umbraco Persistent Password Reset Poison](https://agentprime.io/advisories/GHSA-r8pr-83cc-ccv7.md)
  `GHSA-r8pr-83cc-ccv7`, `CVE-2022-22691` · NuGet `Umbraco.Cms.Core`: affected `<9.2.0`, fixed in `9.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 21 Jan 2022 · Tags: HTTP request smuggling, CWE-640
- [Umbraco ApplicationURL Overwrite](https://agentprime.io/advisories/GHSA-jrmq-rv9w-63rv.md)
  `GHSA-jrmq-rv9w-63rv`, `CVE-2022-22690` · NuGet `Umbraco.Cms.Core`: affected `<9.2.0`, fixed in `9.2.0` · CVSS 8.6 High · Not analysed yet · Published 21 Jan 2022 · Tags: HTTP request smuggling
- [HTTP request smuggling in netty](https://agentprime.io/advisories/GHSA-wx5j-54mm-rqqq.md)
  `GHSA-wx5j-54mm-rqqq`, `CVE-2021-43797` · Maven `io.netty:netty` and 2 more: affected `*`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 9 Dec 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in github.com/hyperledger/fabric](https://agentprime.io/advisories/GHSA-j96p-r523-8r3w.md)
  `GHSA-j96p-r523-8r3w`, `CVE-2021-43669` · Go `github.com/hyperledger/fabric`: affected `<2.4.0`, fixed in `2.4.0` · CVSS 7.5 High · Not analysed yet · Published 3 Dec 2021 · Tags: HTTP request smuggling
- [Webcache Poisoning in shopware/platform and shopware/core](https://agentprime.io/advisories/GHSA-r64m-qchj-hrjp.md)
  `GHSA-r64m-qchj-hrjp`, `PKSA-j2jt-n24d-59bf`, `PKSA-r6j6-5wr2-cc9q` · Packagist `shopware/core` and 1 more: affected `<6.4.6.1`, fixed in `6.4.6.1` · No CVSS score · Not analysed yet · Published 24 Nov 2021 · Tags: HTTP request smuggling
- [Webcache Poisoning in symfony/http-kernel](https://agentprime.io/advisories/GHSA-q3j3-w37x-hq2q.md)
  `GHSA-q3j3-w37x-hq2q`, `BIT-symfony-2021-41267`, `CVE-2021-41267`, `PKSA-2dmf-r1fg-t642`, `PKSA-ftqt-8gzv-r53t` · Packagist `symfony/http-kernel` and 1 more: affected `>=5.2.0, <5.3.12`, fixed in `5.3.12` · CVSS 6.5 Medium · Not analysed yet · Published 24 Nov 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2021-22959.md)
  `CVE-2021-22959` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 15 Nov 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in Node](https://agentprime.io/advisories/CVE-2021-22960.md)
  `CVE-2021-22960` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: HTTP request smuggling
- [Request Smuggling - LF line ending](https://agentprime.io/advisories/CVE-2021-37147.md)
  `CVE-2021-37147` · CVE record: Apache Software Foundation Apache Traffic Server · No CVSS score · Not analysed yet · Published 3 Nov 2021 · Tags: HTTP request smuggling, CWE-20
- [Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling](https://agentprime.io/advisories/GHSA-48w2-rm65-62xx.md)
  `GHSA-48w2-rm65-62xx`, `CVE-2021-41136` · RubyGems `puma`: affected `<4.3.9 || >=5.0.0, <5.5.1`, fixed in `4.3.9`, `5.5.1` · CVSS 3.7 Low · Not analysed yet · Published 12 Oct 2021 · Tags: HTTP request smuggling
- [Async-h1 request smuggling possible with long unread bodies](https://agentprime.io/advisories/GHSA-4vr9-8cjf-vf9c.md)
  `GHSA-4vr9-8cjf-vf9c`, `CVE-2020-26281`, `CVE-2020-36202`, `GHSA-c8rq-crxj-mj9m`, `RUSTSEC-2020-0093` · crates.io `async-h1`: affected `<2.3.0`, fixed in `2.3.0` · CVSS 6.8 Medium · Not analysed yet · Published 12 Oct 2021 · Tags: HTTP request smuggling
- [An issue was discovered in zeek version 4.1.0.](https://agentprime.io/advisories/CVE-2021-41732.md)
  `CVE-2021-41732` · CVE record · CVSS 8.2 High · Not analysed yet · Published 29 Sept 2021 · Tags: HTTP request smuggling
- [Lacking Protection against HTTP Request Smuggling in mitmproxy](https://agentprime.io/advisories/GHSA-22gh-3r9q-xf38.md)
  `GHSA-22gh-3r9q-xf38`, `CVE-2021-39214`, `PYSEC-2021-328` · PyPI `mitmproxy`: affected `<7.0.3`, fixed in `7.0.3` · CVSS 8.1 High · Not analysed yet · Published 20 Sept 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in SAP SE SAP Web Dispatcher](https://agentprime.io/advisories/CVE-2021-38162.md)
  `CVE-2021-38162` · CVE record: SAP SE SAP Web Dispatcher · CVSS 8.9 High · Not analysed yet · Published 14 Sept 2021 · Tags: HTTP request smuggling
- [A vulnerability in WirelessHART-Gateway <= 3.0.8 may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings](https://agentprime.io/advisories/CVE-2021-34559.md)
  `CVE-2021-34559` · CVE record: Phoenix Contact WHA-GW-F2D2-0-AS- Z2-ETH and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 31 Aug 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in actix-http](https://agentprime.io/advisories/GHSA-8928-2fgm-6x9x.md)
  `GHSA-8928-2fgm-6x9x`, `CVE-2021-38512`, `RUSTSEC-2021-0081` · crates.io `actix-http`: affected `<2.2.1`, fixed in `2.2.1` · CVSS 7.5 High · Not analysed yet · Published 25 Aug 2021 · Tags: HTTP request smuggling
- [HTTP Request smuggling in tiny_http](https://agentprime.io/advisories/GHSA-7v2r-wxmg-mgvc.md)
  `GHSA-7v2r-wxmg-mgvc`, `CVE-2020-35884`, `RUSTSEC-2020-0031` · crates.io `tiny_http`: affected `<0.8.0`, fixed in `0.8.0` · CVSS 6.5 Medium · Not analysed yet · Published 25 Aug 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in hyper](https://agentprime.io/advisories/GHSA-h3qr-rq2j-74w4.md)
  `GHSA-h3qr-rq2j-74w4`, `CVE-2020-35863`, `RUSTSEC-2020-0008` · crates.io `hyper`: affected `>=0.11.0, <0.12.34`, fixed in `0.12.34` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Aug 2021 · Tags: HTTP request smuggling
- [HTTP Request Smuggling in Apache Tomcat](https://agentprime.io/advisories/GHSA-4vww-mc66-62m6.md)
  `GHSA-4vww-mc66-62m6`, `BIT-tomcat-2021-33037`, `CVE-2021-33037` · Maven `org.apache.tomcat:tomcat`: affected `>=10.0.0-M1, <10.0.7 || >=9.0.0-M1, <9.0.48 || >=8.5.0, <8.5.68`, fixed in `10.0.7`, `9.0.48`, `8.5.68` · CVSS 5.3 Medium · EPSS 0.75 · Not analysed yet · Published 13 Aug 2021 · Tags: HTTP request smuggling
- [HTTP request smuggling in SAP SE SAP Web Dispatcher and Internet Communication Manager](https://agentprime.io/advisories/CVE-2021-33683.md)
  `CVE-2021-33683` · CVE record: SAP SE SAP Web Dispatcher and Internet Communication Manager · CVSS 5.4 Medium · Not analysed yet · Published 14 Jul 2021 · Tags: HTTP request smuggling

Newest: <https://agentprime.io/advisories/tag/request-smuggling.md>
Older: <https://agentprime.io/advisories/tag/request-smuggling.md?cursor=WyIyMDIxLTA3LTE0VDExOjA0OjQ1LjAwMDAwMFoiLCJDVkUtMjAyMS0zMzY4MyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=request-smuggling&cursor=WyIyMDIzLTA4LTAzVDE2OjM2OjM0LjAwMDAwMFoiLCJHSFNBLTZqd2MtcXIycS03eHdqIl0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/request-smuggling/?cursor=WyIyMDIzLTA4LTAzVDE2OjM2OjM0LjAwMDAwMFoiLCJHSFNBLTZqd2MtcXIycS03eHdqIl0>. Everything for agents: <https://agentprime.io/llms.txt>.