Advisories · Weakness
HTTP request smuggling.
Front and back ends that disagree on where a request ends. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 3.1 Low
Lenient `hyper` header parsing of `Content-Length` could allow request smuggling
- HTTP request smuggling
>=0.0.0-0, <0.14.10 · fixed in 0.14.10
GHSA-f3pg-qwvg-p99c · CVE-2021-32715 -
HTTP Request Smuggling, content length with invalid charters
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
-
Incorrect handling of url fragment leads to cache poisoning
- Apache Software Foundation Apache Traffic Server
- HTTP request smuggling
- CVSS 7.1 High
Inconsistent Interpretation of HTTP Requests in github.com/gin-gonic/gin
- Other injection
- HTTP request smuggling
<1.7.7 · fixed in 1.7.7
GHSA-h395-qcrw-5vmq · CVE-2020-28483 - CVSS 6.1 Medium
HTTP Request Smuggling in netius
- HTTP request smuggling
<1.17.58 · fixed in 1.17.58
GHSA-wm2m-xrrp-j74c · CVE-2020-7655 - CVSS 4.8 Medium
HTTP request smuggling in Undertow
- HTTP request smuggling
>=2.1.0, <2.1.6 || <2.0.34 · fixed in 2.1.6, 2.0.34
GHSA-qjwc-v72v-fq6r · CVE-2021-20220 - CVSS 7.5 High
HTTP Request Smuggling in goliath
- HTTP request smuggling
<=1.0.6 · no fixed version yet
GHSA-3892-2r52-p65m · CVE-2020-7671 - CVSS 7.5 High
HTTP Request Smuggling in reel
- HTTP request smuggling
<=0.6.1 · no fixed version yet
GHSA-x3v4-pxvm-63j8 · CVE-2020-7659 - CVSS 5.0 Medium
HTTP Request Smuggling in akka-http-core
- HTTP request smuggling
>=10.2.0, <10.2.4 || <10.1.14 · fixed in 10.2.4, 10.1.14
GHSA-2w7w-2j92-44hx · CVE-2021-23339 - CVSS 4.8 Medium
HTTP Request Smuggling in Undertow
- HTTP request smuggling
<2.2.0.Final · fixed in 2.2.0.Final
GHSA-p9w3-gwc2-cr49 · CVE-2020-10687 - CVSS 6.5 Medium
HTTP Request Smuggling in Undertow
- HTTP request smuggling
<2.1.1.Final · fixed in 2.1.1.Final
GHSA-cccf-7xw3-p2vr · CVE-2020-10719 - CVSS 6.8 Medium
bottle HTTP Request smuggling
- HTTP request smuggling
<0.12.19 · fixed in 0.12.19
GHSA-qhx9-7hx7-cp4r · CVE-2020-28473 - CVSS 5.9 Medium
Possible request smuggling in HTTP/2 due missing validation of content-length
- HTTP request smuggling
* · no fixed version yet
GHSA-f256-j965-7f32 · CVE-2021-21409 - CVSS 5.9 Medium
Possible request smuggling in HTTP/2 due missing validation
- HTTP request smuggling
* · no fixed version yet
GHSA-wm47-8v5p-wjpj · CVE-2021-21295 - CVSS 5.9 Medium
Web Cache Poisoning
- python/cpython
- HTTP request smuggling
- CVSS 4.8 Medium
Multiple Transfer-Encoding headers misinterprets request payload
- HTTP request smuggling
>=0.12.0, <0.12.36 || >=0.13.0-0, <0.13.10 || >=0.14.0-0, <0.14.3 · fixed in 0.12.36, 0.13.10, 0.14.3
GHSA-6hfq-h8hq-87mf · CVE-2021-21299 -
HTTP request smuggling in Node
- Node
- HTTP request smuggling
- CVSS 5.9 Medium
Web Cache Poisoning in find-my-way
- HTTP request smuggling
<2.2.5 || >=3.0.0, <3.0.5 · fixed in 2.2.5, 3.0.5
GHSA-jgrh-5m3h-9c5f · CVE-2020-7764 -
Withdrawn: HTTP Request Smuggling in Agoo
- HTTP request smuggling
<=2.13.0 · no fixed version yet
GHSA-h385-52j6-9984 · CVE-2020-7670 -
HTTP request smuggling in Node
- Node
- HTTP request smuggling
- CVSS 6.8 Medium
HTTP Smuggling via Transfer-Encoding Header in Puma
- HTTP request smuggling
<3.12.6 || >=4.0.0, <4.3.5 · fixed in 3.12.6, 4.3.5
GHSA-w64w-qqph-5gxm · CVE-2020-11077 - CVSS 7.5 High
HTTP Smuggling via Transfer-Encoding Header in Puma
- HTTP request smuggling
<3.12.5 || >=4.0.0, <4.3.4 · fixed in 3.12.5, 4.3.4
GHSA-x7jg-6pwg-fx5h · CVE-2020-11076 - CVSS 6.5 Medium
Improper Neutralization of CRLF Sequences in HTTP Headers in Jooby ('HTTP Response Splitting)
- HTTP request smuggling
<2.2.1 · fixed in 2.2.1
GHSA-gv3v-92v6-m48j · CVE-2020-7622 - CVSS 9.8 CriticalCritical · CVSS 9+
Improper Input Validation in Twisted
- HTTP request smuggling
- CWE-20
<20.3.0 · fixed in 20.3.0
GHSA-h96w-mmrf-2h6v · CVE-2020-10108 - CVSS 9.8 CriticalCritical · CVSS 9+
HTTP Request Smuggling in Twisted
- HTTP request smuggling
<20.3.0 · fixed in 20.3.0
GHSA-p5xh-vx83-mxcj · CVE-2020-10109 - CVSS 9.8 CriticalCritical · CVSS 9+
Micronaut's HTTP client is vulnerable to HTTP Request Header Injection
- HTTP request smuggling
<1.2.11 || >=1.3.0, <1.3.2 · fixed in 1.2.11, 1.3.2
GHSA-694p-xrhg-x3wm · CVE-2020-7611 - CVSS 4.8 Medium
Potential HTTP request smuggling in Apache Tomcat
- HTTP request smuggling
>=7.0.98, <7.0.100 || >=8.5.48, <8.5.51 || >=9.0.28, <9.0.31 · fixed in 7.0.100, 8.5.51, 9.0.31
GHSA-767j-jfh2-jvrc · CVE-2019-17569 - CVSS 4.8 Medium
Potential HTTP request smuggling in Apache Tomcat
- HTTP request smuggling
<7.0.100 || >=8.0.0, <8.5.51 || >=9.0.0, <9.0.31 · fixed in 7.0.100, 8.5.51, 9.0.31
GHSA-qxf4-chvg-4r8r · CVE-2020-1935 - CVSS 7.5 High
HTTP Request Smuggling in Netty
- HTTP request smuggling
>=4.1.43, <4.1.45 · fixed in 4.1.45
GHSA-ff2w-cq2g-wv5f · CVE-2020-7238 - CVSS 9.1 CriticalCritical · CVSS 9+
HTTP Request Smuggling in Netty
- HTTP request smuggling
* · no fixed version yet
GHSA-cqqj-4p63-rrmm · CVE-2019-20444 -
HTTP Request Smuggling in Netty
- HTTP request smuggling
* · no fixed version yet
GHSA-p2v9-g2qv-p635 · CVE-2019-20445 -
HTTP request smuggling in Node
- Node
- HTTP request smuggling
- CVSS 4.4 Medium
Ability to expose data in Sylius by using an unintended serialisation group
- Information disclosure
- HTTP request smuggling
>=1.0.0, <1.3.13 || >=1.4.0, <1.4.6 || >=1.5.0, <1.5.1 || >=1.6.0, <1.6.3 · fixed in 1.3.13, 1.4.6, 1.5.1, 1.6.3
GHSA-8vp7-j5cj-vvm2 · CVE-2020-5218 - CVSS 5.4 Medium
Request smuggling is possible when both chunked TE and content length specified
- HTTP request smuggling
<1.3.0 · fixed in 1.3.0
GHSA-xrr9-rh8p-433v · CVE-2020-5207 - CVSS 7.1 High
HTTP Request Smuggling in Waitress: Invalid whitespace characters in headers (Follow-up)
- HTTP request smuggling
<1.4.2 · fixed in 1.4.2
GHSA-968f-66r5-5v74 · CVE-2019-16789 -
HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress
- HTTP request smuggling
<1.4.1 · fixed in 1.4.1
GHSA-m5ff-3wj3-8ph4 - CVSS 7.1 High
HTTP Request Smuggling: Content-Length Sent Twice in Waitress
- HTTP request smuggling
<1.4.0 · fixed in 1.4.0
GHSA-4ppp-gpcr-7qf6 · CVE-2019-16792 - CVSS 7.1 High
HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress
- HTTP request smuggling
<1.4.0 · fixed in 1.4.0
GHSA-g2xc-35jw-c63p · CVE-2019-16786 - CVSS 7.1 High
HTTP Request Smuggling: LF vs CRLF handling in Waitress
- HTTP request smuggling
<1.4.0 · fixed in 1.4.0
GHSA-pg36-wpm5-g57p · CVE-2019-16785 - CVSS 7.5 High
HTTP Request Smuggling in Netty
- HTTP request smuggling
>=3.3.0.Final, <=4.0.0.Alpha8 · no fixed version yet
GHSA-p979-4mfw-53vg · CVE-2019-16869 - CVSS 7.5 High
Parse Server before v3.4.1 vulnerable to Denial of Service
- HTTP request smuggling
<3.4.1 · fixed in 3.4.1
GHSA-2479-qvv7-47qq · CVE-2019-1020012 - CVSS 6.5 Medium
Undertow-core vulnerable to HTTP Request Smuggling
- HTTP request smuggling
<1.3.31 || >=1.4.0, <1.4.17 · fixed in 1.3.31, 1.4.17
GHSA-mcfm-h73v-635m · CVE-2017-2666 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
- HTTP request smuggling
<9.2.25.v20180606 || >=9.3.0, <9.3.24.v20180605 || >=9.4.0, <9.4.11.v20180605 · fixed in 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605
GHSA-6x9x-8qw9-9pp6 · CVE-2017-7658 - CVSS 7.5 High
Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
- HTTP request smuggling
<9.3.24.v20180605 || >=9.4.0, <9.4.11.v20180605 · fixed in 9.3.24.v20180605, 9.4.11.v20180605
GHSA-84q7-p226-4x5w · CVE-2017-7656 - CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS
Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
- Memory corruption
- HTTP request smuggling
<9.2.25.v20180606 || >=9.3.0, <9.3.24.v20180605 · fixed in 9.2.25.v20180606, 9.3.24.v20180605
GHSA-vgg8-72f2-qm23 · CVE-2017-7657