HTTP request smuggling.

HTTP/2 Stream Parser Confusion Body-Inspection Bypass in AWS Application Load Balancer with AWS WAF

• AWS Application Load Balancer
• HTTP request smuggling

HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

• AWS Amazon CloudFront
• HTTP request smuggling

nghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-Length

• nghttp2
• HTTP request smuggling

PHP Standard Library: HTTP/2 server-side missing content-length validation enables request smuggling

• HTTP request smuggling

>=6.1.0, <6.1.2 || >=6.2.0, <6.2.1 · fixed in 6.1.2, 6.2.1

Envoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-Length

• envoy
• HTTP request smuggling

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities

• IBM WebSphere Application Server
• IBM WebSphere Application Server - Liberty
• HTTP request smuggling

http4k: `reverseProxy()` defaulted to substring (`Contains`) matching on `Host`; tightened to `Exact`

• HTTP request smuggling

>=6.0.0.0, <6.49.0.0 || >=5.0.0.0, <5.42.0.0 || <4.51.0.0 · fixed in 6.49.0.0, 5.42.0.0, 4.51.0.0

Tinyproxy - HTTP Request Smuggling via Duplicate Content-Length Headers

• tinyproxy
• HTTP request smuggling

Tinyproxy - HTTP Request Smuggling via CL/TE Desynchronization

• tinyproxy
• HTTP request smuggling

Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

• Authentication bypass
• HTTP request smuggling

<=1.0.5 · no fixed version yet

vLLM: OpenAI auth bypass

• HTTP request smuggling
• CWE-501

>=0.3.0, <0.22.0 · fixed in 0.22.0

Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

• HTTP request smuggling

>=4.2.0.Final, <4.2.15.Final || <4.1.135.Final · fixed in 4.2.15.Final, 4.1.135.Final

python-multipart: Semicolon treated as querystring field separator enables parameter smuggling

• HTTP request smuggling
• CWE-436

<0.0.30 · fixed in 0.0.30

HTTP request smuggling in Kong Enteprise Gateway

• Kong Enterprise Gateway
• HTTP request smuggling

Spring Framework Multipart Request Smuggling in Spring MVC and WebFlux

• HTTP request smuggling

>=7.0.0, <7.0.8 || >=6.2.0, <6.2.19 || >=6.1.0, <=6.1.21 || <=5.3.39 · fixed in 7.0.8, 6.2.19

Hono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded paths

• HTTP request smuggling
• CWE-693

<4.12.21 · fixed in 4.12.21

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

• HTTP request smuggling
• CWE-1289

<1.0.1 · fixed in 1.0.1

daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, o...

• HTTP request smuggling

<4.2.2 · fixed in 4.2.2

HTTP request smuggling in Vinyl Cache and others

• Vinyl Cache
• The Vinyl Cache Project Varnish Cache (pre split)
• HTTP request smuggling

HTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsing

• HTTP request smuggling

>=0.1.0, <1.9.0 · fixed in 1.9.0

cpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injection

• yhirose cpp-httplib
• Other injection
• HTTP request smuggling

Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• HTTP request smuggling

IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-ins

• IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty
• HTTP request smuggling

Nuxt: `__nuxt_island` endpoint does not bind responses to request props, enabling shared-cache poisoning

• Cross-site scripting (XSS)
• HTTP request smuggling

>=3.1.0, <3.21.6 || >=4.0.0-alpha.1, <4.4.6 · fixed in 3.21.6, 4.4.6

Netty vulnerable to HTTP Request Smuggling due to malformed Transfer-Encoding

• HTTP request smuggling

>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final · fixed in 4.2.13.Final, 4.1.133.Final

Netty has HttpClientCodec response desynchronization

• HTTP request smuggling

>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final · fixed in 4.2.13.Final, 4.1.133.Final

Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization

• HTTP request smuggling

>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final · fixed in 4.2.13.Final, 4.1.133.Final

Netty vulnerable to HTTP Request Smuggling due to incorrect chunk size parsing

• Memory corruption
• HTTP request smuggling

>=4.2.0.Alpha1, <4.2.13.Final || <4.1.133.Final · fixed in 4.2.13.Final, 4.1.133.Final

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence

• KAZEBURO Gazelle
• HTTP request smuggling

Netty: Start-Line Injection in DefaultHttpRequest.setUri() Allows HTTP Request Smuggling and RTSP Request Injection

• Other injection
• HTTP request smuggling

<4.1.133.Final || >=4.2.0.Alpha1, <4.2.13.Final · fixed in 4.1.133.Final, 4.2.13.Final

Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence

• KAZUHO Starlet
• HTTP request smuggling

CL.CL HTTP request smuggling via duplicate Content-Length in bandit

• HTTP request smuggling

>=0.1.0, <1.11.0 · fixed in 1.11.0

Starman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header Precedence

• MIYAGAWA Starman
• HTTP request smuggling

Pony Mail: Admin account takeover via request smuggling

• Apache Software Foundation Pony Mail
• HTTP request smuggling

Libsoup: libsoup: http request smuggling via duplicate content-length headers

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• HTTP request smuggling

actix-http has HTTP/1.1 CL.TE Request Smuggling

• HTTP request smuggling

<3.12.1 · fixed in 3.12.1

HCL BigFix Service Management (SM) is susceptible to HTTP Request Smuggling

• HCLSoftware BigFix Service Management (SM)
• HTTP request smuggling

Fastify's connection header abuse enables stripping of proxy-added headers

• HTTP request smuggling
• CWE-644

<11.4.4 · fixed in 11.4.4

Jetty has HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

• HTTP request smuggling

>=12.1.0, <12.1.7 || >=12.0.0, <12.0.33 || >=11.0.0, <11.0.29 || >=10.0.0, <10.0.28 || >=9.4.0, <9.4.60 · fixed in 12.1.7, 12.0.33, 11.0.29, 10.0.28, 9.4.60

Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

• Other injection
• HTTP request smuggling

<0.31.0 || >=1.0.0, <1.15.0 · fixed in 0.31.0, 1.15.0

Apache Tomcat has an HTTP Request/Response Smuggling vulnerability

• HTTP request smuggling

>=7.0.0, <9.0.116 || >=10.1.0-M1, <10.1.52 || >=11.0.0-M1, <11.0.20 · fixed in 9.0.116, 10.1.52, 11.0.20

Tinyproxy HTTP request parsing desynchronization via case-sensitive Transfer-Encoding handling

• Tinyproxy
• HTTP request smuggling

Apache Traffic Server: Malformed chunked message body allows request smuggling

• Apache Software Foundation Apache Traffic Server
• HTTP request smuggling

AIOHTTP accepts duplicate Host headers

• HTTP request smuggling
• CWE-20

<3.13.4 · fixed in 3.13.4

Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access Container
• IBM Security Verify Access Container
• HTTP request smuggling

Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

• IBM Verify Identity Access Container
• IBM Security Verify Access Container
• HTTP request smuggling

cpp-httplib: HTTP Request Smuggling via Unconsumed GET Request Body

• yhirose cpp-httplib
• HTTP request smuggling

Undertow is Vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

<2.2.40.Final || >=2.3.0.Final, <2.3.25.Final · fixed in 2.2.40.Final, 2.3.25.Final

Undertow is Vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

<2.2.40.Final || >=2.3.0.Final, <2.3.25.Final · fixed in 2.2.40.Final, 2.3.25.Final

Undertow is Vulnerable to HTTP Request/Response Smuggling

• HTTP request smuggling

>=2.3.0.Final, <2.3.25.Final || <2.2.40.Final · fixed in 2.3.25.Final, 2.2.40.Final

Netty: HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

• HTTP request smuggling

<4.1.132.Final || >=4.2.0.Alpha1, <4.2.10.Final · fixed in 4.1.132.Final, 4.2.10.Final

Mitigation bypass in the Networking: HTTP component

• Mozilla Firefox
• Mozilla Thunderbird
• Authentication bypass
• HTTP request smuggling

HTTP Request Smuggling in visualfc/liteide

• visualfc liteide
• HTTP request smuggling

Next.js: HTTP request smuggling in rewrites

• HTTP request smuggling

>=9.5.0, <15.5.13 || >=16.0.0-beta.0, <16.1.7 · fixed in 15.5.13, 16.1.7

Undici has an HTTP Request/Response Smuggling issue

• HTTP request smuggling

<6.24.0 || >=7.0.0, <7.24.0 · fixed in 6.24.0, 7.24.0

Request smuggling via first-wins Content-Length parsing in inets httpd

• Erlang OTP
• HTTP request smuggling

Cap'n Proto: Integer overflow in KJ-HTTP chunk size

• capnproto
• HTTP request smuggling
• CWE-197

Cap'n Proto has an integer overflow in KJ-HTTP

• capnproto
• Memory corruption
• HTTP request smuggling

TinyWeb: Integer Overflow in `_Val` (HTTP Request Smuggling)

• maximmasiutin TinyWeb
• Memory corruption
• HTTP request smuggling

Pingora has HTTP Request Smuggling via HTTP/1.0 and Transfer-Encoding Misparsing

• HTTP request smuggling

<0.8.0 · fixed in 0.8.0