Advisories · Weakness
HTTP request smuggling.
Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
-
Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
- Apache Software Foundation Apache Sling Engine
- HTTP request smuggling
- CWE-436
- CVSS 6.9 Medium
uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matching
- openwrt uhttpd
- HTTP request smuggling
- CVSS 3.7 Low
uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state reset
- openwrt uhttpd
- HTTP request smuggling
- CVSS 6.9 Medium
uhttpd: HTTP request smuggling via ubus POST body parse-error desync
- openwrt uhttpd
- HTTP request smuggling
-
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection
- HTTP request smuggling
- CVSS 6.5 Medium
Undertow: undertow: chunkreader message length permits chunk-size overflow
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat Enterprise Linux 8
- HTTP request smuggling
- CVSS 2.9 Low
Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
- HTTP request smuggling
<2.11.5 · fixed in 2.11.5
GHSA-8qx7-j2v2-x6q5 · CVE-2026-55458 - CVSS 2.0 Low
Lenient parsing of integers for response body and chunk framing
- Python Software Foundation CPython
- HTTP request smuggling
- CVSS 6.3 Medium
Chunk extensions accept bare LF and CR, enabling request smuggling in Bandit
- HTTP request smuggling
>=1.12.4, <1.14.0 · fixed in 1.14.0
GHSA-w5wc-g2hc-g7m2 · CVE-2026-114216 - CVSS 9.1 CriticalCritical · CVSS 9+
Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
- HTTP request smuggling
- Broken access control
>=4.0.0, <4.16.1 · fixed in 4.16.1
GHSA-cxf3-9h37-7rr8 · CVE-2026-118264 - CVSS 5.4 Medium
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
- HTTP request smuggling
<26.10.0rc1 · fixed in 26.10.0rc1
GHSA-q7qq-6mhp-9rc4 · CVE-2026-115877 - CVSS 7.5 High
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLab
- GitLab
- HTTP request smuggling
- CVSS 6.9 Medium
Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 9.2 CriticalCritical · CVSS 9+
Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-out
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 7.0 High
Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new request
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 7.5 High
Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
- Apache Software Foundation Apache bRPC
- HTTP request smuggling
- CVSS 6.3 Medium
AIOHTTP: Pure-Python parser request smuggling
- HTTP request smuggling
<3.14.4 · fixed in 3.14.4
GHSA-pqxq-w44r-73xw · CVE-2026-111750 - CVSS 6.9 Medium
NetX Duo Web HTTP server interprets request body content as HTTP header fields
- Eclipse Foundation Eclipse ThreadX - NetX Duo
- HTTP request smuggling
- CVSS 8.7 High
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
- HTTP request smuggling
>=0.0.0-0, <0.9.0 · fixed in 0.9.0
GHSA-vx4q-2c55-cvmg · CVE-2026-105299 - CVSS 6.3 Medium
Pingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypass
- HTTP request smuggling
>=0.0.0-0, <0.9.0 · fixed in 0.9.0
GHSA-mgg9-6xw2-jfgp · CVE-2026-105298 - CVSS 6.3 Medium
`wasi-http`: Guests can add conflicting content lengths to messages
- HTTP request smuggling
>=0.0.0-0, <36.0.19 || >=37.0.0, <48.0.7 || >=49.0.0, <49.0.4 · fixed in 36.0.19, 48.0.7, 49.0.4
GHSA-r8xh-cgf7-392j · CVE-2026-121441 - CVSS 6.9 Medium
`wasi-http` p3: Guests can set incorrect content-length for spliced response bodies
- HTTP request smuggling
>=46.0.0, <48.0.7 || >=49.0.0, <49.0.4 · fixed in 48.0.7, 49.0.4
GHSA-9prg-84vf-g5fc · CVE-2026-121439 - CVSS 7.1 High
pupnp: Integer truncation in HTTP Content-Length parsing enables request smuggling
- pupnp
- Memory corruption
- HTTP request smuggling
- CVSS 8.7 High
HTTP request smuggling in Eclipse Foundation Eclipse Vert.x
- Eclipse Foundation Eclipse Vert.x
- HTTP request smuggling
- CVSS 7.2 High
Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
- Red Hat Hardened Images
- HTTP request smuggling
- CVSS 9.4 CriticalCritical · CVSS 9+
Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability
- HTTP request smuggling
>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2
GHSA-rv87-ccxw-8ggf · CVE-2026-88092 - CVSS 9.1 CriticalCritical · CVSS 9+
Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability
- HTTP request smuggling
>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2
GHSA-fpq8-4vhr-rcxx · CVE-2026-70188 - CVSS 7.7 High
Squid Request Smuggling in HTTP Transfer-Encoding
- squid
- HTTP request smuggling
- CVSS 7.5 High
HTTP/1 server connection desynchronization after 2xx CONNECT response in net/http
- HTTP request smuggling
<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2
GO-2026-6613 · CVE-2026-94439 - CVSS 7.5 High
HTTP/2 transport accepts malformed framing-related headers in net/http
- HTTP request smuggling
<0.60.0 · fixed in 0.60.0
GO-2026-6610 · CVE-2026-78660 - CVSS 7.5 High
HTTP/1 client connection desynchronization after CONNECT rejection in net/http
- HTTP request smuggling
<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2
GO-2026-6605 · CVE-2026-56866 - CVSS 3.6 Low
Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic
- Progress Software Progress® Telerik® Fiddler® Classic
- HTTP request smuggling
- CVSS 6.3 Medium
HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic
- Progress Software Progress® Telerik® Fiddler® Classic
- HTTP request smuggling
- CVSS 7.5 High
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
- Apache Software Foundation Apache HTTP Server
- HTTP request smuggling
- CVSS 5.3 Medium
Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- HTTP request smuggling
- CVSS 3.7 Low
undici vulnerable to downstream response splitting via retry interceptor
- HTTP request smuggling
<6.28.1 || >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2 · fixed in 6.28.1, 7.29.1, 8.10.2
GHSA-r53p-7pc4-xj5r · CVE-2026-18540 - CVSS 6.3 Medium
Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
- HTTP request smuggling
>=0.1.0, <1.10.2 · fixed in 1.10.2
GHSA-gvrc-75rc-7gj9 · CVE-2026-94194 - CVSS 9.3 CriticalCritical · CVSS 9+
HTTP Request Smuggling
- Citrix NetScaler ADC
- Citrix NetScaler Gateway
- HTTP request smuggling
- CVSS 6.9 Medium
Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec
- netty
- HTTP request smuggling
- CVSS 6.9 Medium
Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass
- netty
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
- Apache Software Foundation Apache Tomcat
- HTTP request smuggling
- CVSS 3.7 Low
Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
- Apache Software Foundation Apache Tomcat
- HTTP request smuggling
- CVSS 7.5 High
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
- envoy
- HTTP request smuggling
- CVSS 6.3 Medium
Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
- HTTP request smuggling
>=0.1.0, <1.10.1 · fixed in 1.10.1
GHSA-rj5m-69wp-cxq9 · CVE-2026-82672 - CVSS 6.5 Medium
Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing
- Red Hat Build of Debezium 3.6
- Red Hat build of Quarkus 3.27.5.SP2
- HTTP request smuggling
- CVSS 4.8 Medium
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 6.5 Medium
IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerability
- IBM WebSphere Application Server
- HTTP request smuggling
- CVSS 4.8 Medium
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 4.8 Medium
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 6.5 Medium
Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling
- Red Hat Build of Debezium 3.6
- Red Hat build of Quarkus 3.27.5.SP2
- HTTP request smuggling
- CVSS 8.2 High
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
- Red Hat Build of Apache Camel 3.33.3.SP2
- Red Hat Build of Debezium 3.6
- HTTP request smuggling
- CVSS 6.5 Medium
Breeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters
- Breeze Cache
- HTTP request smuggling
- CVSS 6.5 Medium
sanic chunked trailer request smuggling allows hidden second request execution
- HTTP request smuggling
<24.12.1 || >=25.12.0, <25.12.1 · fixed in 24.12.1, 25.12.1
GHSA-wmj6-g64g-j7q5 · CVE-2026-85078 - CVSS 5.4 Medium
Http4s: Ember chunk parser lenience (TE.TE request smuggling)
- HTTP request smuggling
<0.23.35 · fixed in 0.23.35
GHSA-jrpm-956j-96jg · CVE-2026-69216 - CVSS 8.7 High
Http4s Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)
- HTTP request smuggling
<0.23.35 · fixed in 0.23.35
GHSA-9998-894r-fwvr · CVE-2026-69205 - CVSS 9.2 CriticalCritical · CVSS 9+
Http4s Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)
- HTTP request smuggling
<0.23.35 · fixed in 0.23.35
GHSA-8h4c-x2wg-6xp8 · CVE-2026-69204 - CVSS 9.8 CriticalCritical · CVSS 9+
Ambiguous parsing of mail headers
- Mozilla Thunderbird
- HTTP request smuggling
- CVSS 8.7 High
Http4s: Ember Server accepts duplicate Content-Length headers
- http4s
- HTTP request smuggling