HTTP request smuggling.

io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling

• HTTP request smuggling

<5.3.4 · fixed in 5.3.4

HTTP request smuggling in HAProxy Project HAProxy 2.6 and others

• HAProxy Project HAProxy 2.6
• HAProxy Project HAProxy 2.8
• HTTP request smuggling

Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

• HTTP request smuggling

* || >=25.0.0, <26.0.6 · fixed in 26.0.6

Duplicate Advisory: Keycloak proxy header handling Denial-of-Service (DoS) vulnerability

• HTTP request smuggling

<24.0.9 || >=25.0.0, <26.0.6 · fixed in 24.0.9, 26.0.6

aiohttp allows request smuggling due to incorrect parsing of chunk extensions

• HTTP request smuggling

<3.10.11 · fixed in 3.10.11

Undertow incorrectly parses cookies

• HTTP request smuggling

>=2.3.0.Alpha1, <2.3.11.Final || <2.2.30.Final · fixed in 2.3.11.Final, 2.2.30.Final

GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treate…

• HTTP request smuggling

Waitress has request processing race condition in HTTP pipelining with invalid first request

• Race condition
• HTTP request smuggling

>=2.0.0, <3.0.1 · fixed in 3.0.1

HTTP request smuggling in Oracle Corporation Oracle Banking Liquidity Management

• Oracle Corporation Oracle Banking Liquidity Management
• HTTP request smuggling

kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception.

• HTTP request smuggling

HTTP Request Smuggling in Looker

• Google Looker
• HTTP request smuggling

HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4

• HTTP request smuggling

* · no fixed version yet

Erroneous parsing of multipart form data

• PHP
• HTTP request smuggling

In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

• HTTP request smuggling

HTTP Request Smuggling in ruby webrick

• HTTP request smuggling

<1.8.2 · fixed in 1.8.2

Puma's header normalization allows for client to clobber proxy set headers

• HTTP request smuggling
• Broken access control

<5.6.9 || >=6.0.0, <6.4.3 · fixed in 5.6.9, 6.4.3

Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

• Loway QueueMetrics
• HTTP request smuggling

[20240802] - Core - Cache Poisoning in Pagination

• Joomla! Project Joomla! CMS
• HTTP request smuggling

Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP as value of X-Forwarded-For or Client-I…

• Authentication bypass
• HTTP request smuggling

Authz zero length regression

• HTTP request smuggling
• Broken access control

>=19.03.0, <23.0.15 || >=24.0.0, <25.0.6 || >=26.0.0, <26.1.5 || >=27.0.0, <27.1.1 · fixed in 23.0.15, 25.0.6, 26.1.5, 27.1.1

twisted.web has disordered HTTP pipeline response

• HTTP request smuggling

<24.7.0rc1 · fixed in 24.7.0rc1

Apache Traffic Server: Incomplete field name check allows request smuggling

• Apache Software Foundation Apache Traffic Server
• HTTP request smuggling

Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling

• Apache Software Foundation Apache Traffic Server
• HTTP request smuggling

Symantec Privileged Access Manager Remote Command Execution vulnerability

• Broadcom Symantec Privileged Access Management
• HTTP request smuggling

mhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smuggling

• mhuertos phpLDAPadmin
• HTTP request smuggling

GoRouter Denial of Service Attack

• Cloud Foundry Routing Release
• HTTP request smuggling

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

• HTTP request smuggling

<6.4.1 · fixed in 6.4.1

PingAccess HTTP Request Desynchronization Weakness

• Ping Identity PingAccess
• HTTP request smuggling

Next.js Vulnerable to HTTP Request Smuggling

• HTTP request smuggling

>=13.4.0, <13.5.1 · fixed in 13.5.1

HTTP request smuggling in Node

• Node
• HTTP request smuggling

Apache APISIX: Forward-Auth Request Smuggling

• Apache Software Foundation Apache APISIX
• HTTP request smuggling

HTTP request smuggling in Oracle Corporation Production Scheduling

• Oracle Corporation Production Scheduling
• HTTP request smuggling

Request smuggling leading to endpoint restriction bypass in Gunicorn

• HTTP request smuggling

<22.0.0 · fixed in 22.0.0

Apache HTTP Server: HTTP Response Splitting in multiple modules

• Apache Software Foundation Apache HTTP Server
• Other injection
• HTTP request smuggling

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.

• HTTP request smuggling

Cross-Site Request Forgery in Apache Wicket

• Cross-site request forgery (CSRF)
• HTTP request smuggling

>=9.1.0, <9.17.0 || >=10.0.0-M1, <10.0.0 · fixed in 9.17.0, 10.0.0

An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception by POST HTTP request interception.

• HTTP request smuggling
• Broken access control

HTTP Handling Vulnerability in the Bare server

• HTTP request smuggling

<2.0.2 · fixed in 2.0.2

SMTP smuggling in Apache James

• Authentication bypass
• HTTP request smuggling

<3.7.5 || >=3.8.0, <3.8.1 · fixed in 3.7.5, 3.8.1

HTTP request smuggling in Oracle Corporation Application Object Library

• Oracle Corporation Application Object Library
• HTTP request smuggling

Apache bRPC: HTTP request smuggling vulnerability

• Apache Software Foundation Apache bRPC
• HTTP request smuggling

aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators

• HTTP request smuggling

<3.9.2 · fixed in 3.9.2

chasquid HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<1.13 · fixed in 1.13

Puma HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<5.6.8 || >=6.0.0, <6.4.2 · fixed in 5.6.8, 6.4.2

@fastify/reply-from JSON Content-Type parsing confusion

• HTTP request smuggling

<9.6.0 · fixed in 9.6.0

Client-Side Desynchronization vulnerability in SAP Fiori Launchpad

• SAP_SE SAP Fiori Launchpad
• HTTP request smuggling

Apache Tomcat Improper Input Validation vulnerability

• HTTP request smuggling
• CWE-20

>=11.0.0-M1, <11.0.0-M11 || >=10.1.0-M1, <10.1.16 || >=9.0.0-M1, <9.0.83 || >=8.5.0, <8.5.96 · fixed in 11.0.0-M11, 10.1.16, 9.0.83, 8.5.96

aiohttp has vulnerable dependency that is vulnerable to request smuggling

• HTTP request smuggling

<3.8.6 · fixed in 3.8.6

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

• HTTP request smuggling
• Authentication bypass

>=2022.10.04, <2023.11.14 · fixed in 2023.11.14

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.

• HTTP request smuggling

AIOHTTP has problems in HTTP parser (the python one, not llhttp)

• HTTP request smuggling

<3.8.6 · fixed in 3.8.6

Aiohttp has inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` differing in C and Python fallbacks

• HTTP request smuggling

<3.8.0 · fixed in 3.8.0

Squid: request/response smuggling in http/1.1 and icap

• Red Hat Enterprise Linux 7 Extended Lifecycle Support
• Red Hat Enterprise Linux 8
• HTTP request smuggling

twisted.web has disordered HTTP pipeline response

• HTTP request smuggling

<23.10.0rc1 · fixed in 23.10.0rc1

HTTP request smuggling in Hewlett Packer Enterprise (HPE) HPE MSA Controller

• Hewlett Packer Enterprise (HPE) HPE MSA Controller
• HTTP request smuggling

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, an…

• HTTP request smuggling

Puma HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<5.6.7 || >=6.0.0, <6.3.1 · fixed in 5.6.7, 6.3.1

Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

• HTTP request smuggling

<6.3.3 · fixed in 6.3.3

Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

• Apache Software Foundation Apache Traffic Server
• HTTP request smuggling

protocol-http1 HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

<0.15.1 · fixed in 0.15.1