Advisories · Weakness
HTTP request smuggling.
Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.5 Medium
IBM WebSphere Application Server IBM WebSphere Application Server - Liberty HTTP Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 6.5 Medium
IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Request Smuggling
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 7.0 High
Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization
- HTTP request smuggling
- Broken access control
>=2.11.26, <2.11.57 · fixed in 2.11.57
GHSA-w4v4-9rw7-5326 · CVE-2026-88008 - CVSS 8.8 High
Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging
- HTTP request smuggling
- CWE-1286
<2.11.57 · fixed in 2.11.57
GHSA-f52w-8j3h-j724 · CVE-2026-88009 - CVSS 6.9 Medium
Netty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-Encoding
- netty
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file
- HTTP request smuggling
- CVSS 5.9 Medium
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
- HTTP request smuggling
<4.13.5 · fixed in 4.13.5
GHSA-crvj-82cr-hjcx · CVE-2026-84363 - CVSS 5.6 Medium
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
- HTTP request smuggling
<2.11.0 · fixed in 2.11.0
GHSA-pf96-p4fj-6566 · CVE-2026-84380 - CVSS 8.2 High
Visual Studio Code Security Feature Bypass Vulnerability
- Microsoft Visual Studio Code
- HTTP request smuggling
- CVSS 8.3 High
HTTP request smuggling in Eclipse Foundation Eclipse Jetty
- Eclipse Foundation Eclipse Jetty
- HTTP request smuggling
- CVSS 5.9 Medium
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
- Elasticsearch
- HTTP request smuggling
- CVSS 8.3 High
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
- Erlang OTP
- HTTP request smuggling
- CVSS 8.3 High
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
- Erlang OTP
- HTTP request smuggling
- CVSS 8.3 High
inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
- Erlang OTP
- HTTP request smuggling
- CVSS 3.7 Low
HTTP request smuggling in node
- node
- HTTP request smuggling
- CVSS 6.5 Medium
An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache
- HTTP request smuggling
- CVSS 7.0 High
Apache APISIX: Cross-user response poisoning in serverless plugins
- Apache Software Foundation Apache APISIX
- HTTP request smuggling
- CVSS 5.3 Medium
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
- Other injection
- HTTP request smuggling
- CVSS 9.2 CriticalCritical · CVSS 9+
Libevent: HTTP header handling bugs create risk of access control bypass.
- libevent
- HTTP request smuggling
- CVSS 6.3 Medium
Libevent: HTTP Header smuggling
- libevent
- HTTP request smuggling
- CVSS 9.2 CriticalCritical · CVSS 9+
libevent evhttp: Multiple HTTP Parser Bugs Enable Request Smuggling
- libevent
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
- cesanta mongoose
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
- cesanta mongoose
- HTTP request smuggling
- CVSS 6.1 Medium
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
- Cross-site scripting (XSS)
- HTTP request smuggling
>=2.1.0, <3.1.0 · fixed in 3.1.0
GHSA-fjgc-3mj7-8rg8 · CVE-2026-55087 - CVSS 7.5 High
HTTP request smuggling in Apple servicetalk
- Apple servicetalk
- HTTP request smuggling
- CVSS 5.9 Medium
Microsoft Security Advisory CVE-2026-62899 – .NET Security Feature Bypass Vulnerability
- HTTP request smuggling
>=8.0.0, <8.0.30 || >=9.0.0, <9.0.19 || >=10.0.0, <10.0.11 · fixed in 8.0.30, 9.0.19, 10.0.11
GHSA-r6mh-95jw-g7qg · CVE-2026-62899 - CVSS 5.3 Medium
Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- HTTP request smuggling
- CVSS 6.1 Medium
Instatic - Cache Poisoning via Unauthenticated Server Island Endpoint
- CoreBunch Instatic
- HTTP request smuggling
- CVSS 5.3 Medium
h2: Duplicate Host header could facilitate request smuggling
- HTTP request smuggling
<4.4.1 · fixed in 4.4.1
GHSA-6hr6-w5qg-qmwg · CVE-2026-71554 - CVSS 7.0 High
Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool
- HTTP request smuggling
<=1.7.34 · no fixed version yet
GHSA-3ccp-42pg-hgv6 · CVE-2026-71324 - CVSS 9.1 CriticalCritical · CVSS 9+
HTTP request smuggling in Progress MarkLogic Server
- Progress Software Corporation MarkLogic Server
- HTTP request smuggling
- CVSS 3.7 Low
HTTP request smuggling in node
- node
- HTTP request smuggling
- CVSS 6.3 Medium
AIOHTTP: HTTP request smuggling via WebSocket upgrade
- HTTP request smuggling
<3.14.2 · fixed in 3.14.2
GHSA-mfx4-hv73-q22v · CVE-2026-69243 - CVSS 4.8 Medium
undici vulnerable to downstream response desynchronization via retry interceptor
- HTTP request smuggling
<6.28.0 || >=7.0.0, <7.29.0 || >=8.0.0, <8.9.0 · fixed in 6.28.0, 7.29.0, 8.9.0
GHSA-8xcm-r25x-g524 · CVE-2026-16728 - CVSS 5.6 Medium
HTTP request smuggling in WebPros cPanel and others
- WebPros cPanel
- WebPros WP Squared
- HTTP request smuggling
- CVSS 9.2 CriticalCritical · CVSS 9+
Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 6.3 Medium
Apache Traffic Server: HTTP/2 to HTTP/1 conversion forwards origin trailers to clients unsafely
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 7.8 High
Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 7.0 High
Apache Traffic Server: Malformed chunked message body allows request smuggling
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 6.9 Medium
Apache Traffic Server: Request smuggling via chunked extension quoted-string parsing
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 8.7 High
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 8.7 High
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 7.4 High
IBM WebSphere Application Server and WebSphere Application Server Liberty is inconsistent Interpretation of HTTP Requests
- IBM WebSphere Application Server
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling
- CVSS 6.9 Medium
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
- tomaka rouille
- HTTP request smuggling
- CVSS 6.3 Medium
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
- tomaka rouille
- HTTP request smuggling
- CVSS 6.3 Medium
tiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding Handling
- tiny-http
- HTTP request smuggling
- CVSS 5.4 Medium
Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- HTTP request smuggling
- CVSS 7.4 High
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
- HTTP request smuggling
<0.23.18 · fixed in 0.23.18
GHSA-46q4-43ph-c6fr · CVE-2026-73495 - CVSS 7.4 High
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
- HTTP request smuggling
<0.23.18 || >=1.0.0-M1, <1.0.0-M42 · fixed in 0.23.18, 1.0.0-M42
GHSA-mhvj-jhpq-885v · CVE-2026-73494 - CVSS 5.3 Medium
HTTP request smuggling in Apple swift-nio-http2
- Apple swift-nio-http2
- HTTP request smuggling
- CVSS 6.9 Medium
Netty: [codec-http2] Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass
- HTTP request smuggling
>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-c69g-56f8-xwqj · CVE-2026-59900 - CVSS 6.3 Medium
Netty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation
- HTTP request smuggling
>=4.2.0.Final, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final
GHSA-4mp9-239f-g9hg · CVE-2026-59898 - CVSS 8.2 High
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
- HTTP request smuggling
- CWE-754
<0.27.26 · fixed in 0.27.26
GHSA-8qqm-fp2q-v734 · CVE-2026-65838 - CVSS 6.3 Medium
Sign-tolerant HTTP/1 chunk-size parser in Mint enables response smuggling against strict intermediaries on pooled connections
- HTTP request smuggling
>=0.1.0, <1.9.3 · fixed in 1.9.3
GHSA-x3x7-96vm-6h2w · CVE-2026-59249 - CVSS 6.3 Medium
HTTP request smuggling in Eclipse Foundation Eclipse GlassFish
- Eclipse Foundation Eclipse GlassFish
- HTTP request smuggling
- CVSS 9.1 CriticalCritical · CVSS 9+
SAP Approuter Vulnerable to HTTP Request Smuggling
- HTTP request smuggling
<20.10.0 · fixed in 20.10.0
GHSA-8m85-wqg7-c529 · CVE-2026-27690 - CVSS 7.8 High
Skipper: opaAuthorizeRequestWithBody filter bypasses OPA policy on Transfer-Encoding — chunked / HTTP/2 requests
- HTTP request smuggling
<0.26.10 · fixed in 0.26.10
GHSA-659f-rgp5-w4wf · CVE-2026-50197 - CVSS 6.9 Medium
HTTP request smuggling in OpenVPN Access Server
- OpenVPN Access Server
- HTTP request smuggling
- CVSS 7.4 High
Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.
- IBM CICS Transaction Gateway for Multiplatforms
- HTTP request smuggling
- CVSS 7.2 High
IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability
- IBM WebSphere Application Server - Liberty
- HTTP request smuggling