agentprime: HTTP request smugglingEvery new HTTP request smuggling Advisory and CVE.https://agentprime.io/CVE-2026-103866: Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smugglinghttps://agentprime.io/advisories/CVE-2026-103866/https://agentprime.io/advisories/CVE-2026-103866/Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 12:33:00 GMTCVECVE-2026-55614: uhttpd vulnerable to HTTP request smuggling via case-sensitive Transfer-Encoding matchinghttps://agentprime.io/advisories/CVE-2026-55614/https://agentprime.io/advisories/CVE-2026-55614/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:01:54 GMTCVECVE-2026-55612: uhttpd vulnerable to HTTP request smuggling via invalid chunk-length state resethttps://agentprime.io/advisories/CVE-2026-55612/https://agentprime.io/advisories/CVE-2026-55612/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 22:00:19 GMTCVECVE-2026-55613: uhttpd: HTTP request smuggling via ubus POST body parse-error desynchttps://agentprime.io/advisories/CVE-2026-55613/https://agentprime.io/advisories/CVE-2026-55613/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 21:57:19 GMTCVECVE-2026-116127: Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connectionhttps://agentprime.io/advisories/CVE-2026-116127/https://agentprime.io/advisories/CVE-2026-116127/Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 12:46:11 GMTCVECVE-2026-91920: Undertow: undertow: chunkreader message length permits chunk-size overflowhttps://agentprime.io/advisories/CVE-2026-91920/https://agentprime.io/advisories/CVE-2026-91920/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 01:16:53 GMTCVECaddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughhttps://agentprime.io/advisories/GHSA-8qx7-j2v2-x6q5/https://agentprime.io/advisories/GHSA-8qx7-j2v2-x6q5/github.com/caddyserver/caddy/v2 <2.11.5, fixed in 2.11.5. CVSS 2.9 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Wed, 28 Oct 2026 19:49:33 GMTGogithub.com/caddyserver/caddy/v2CVE-2026-103995: Lenient parsing of integers for response body and chunk framinghttps://agentprime.io/advisories/CVE-2026-103995/https://agentprime.io/advisories/CVE-2026-103995/CVSS 2.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 27 Oct 2026 19:58:52 GMTCVEChunk extensions accept bare LF and CR, enabling request smuggling in Bandithttps://agentprime.io/advisories/GHSA-w5wc-g2hc-g7m2/https://agentprime.io/advisories/GHSA-w5wc-g2hc-g7m2/bandit >=1.12.4, <1.14.0, fixed in 1.14.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 26 Oct 2026 13:30:41 GMTHexbanditCVE-2026-115823: Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connectionshttps://agentprime.io/advisories/CVE-2026-115823/https://agentprime.io/advisories/CVE-2026-115823/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 25 Oct 2026 16:51:19 GMTCVEcriticalEcho: Rejected WebSocket upgrades can bypass Echo route-level access controlshttps://agentprime.io/advisories/GHSA-cxf3-9h37-7rr8/https://agentprime.io/advisories/GHSA-cxf3-9h37-7rr8/github.com/labstack/echo/v4 >=4.0.0, <4.16.1, fixed in 4.16.1. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:49:37 GMTGogithub.com/labstack/echo/v4github.com/labstack/echo/v5criticalTwisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Valuehttps://agentprime.io/advisories/GHSA-q7qq-6mhp-9rc4/https://agentprime.io/advisories/GHSA-q7qq-6mhp-9rc4/twisted <26.10.0rc1, fixed in 26.10.0rc1. CVSS 5.4 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Fri, 23 Oct 2026 20:44:43 GMTPyPItwistedCVE-2026-112212: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in GitLabhttps://agentprime.io/advisories/CVE-2026-112212/https://agentprime.io/advisories/CVE-2026-112212/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 23:33:45 GMTCVECVE-2026-111809: Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable request smugglinghttps://agentprime.io/advisories/CVE-2026-111809/https://agentprime.io/advisories/CVE-2026-111809/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 19:16:16 GMTCVECVE-2026-111816: Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outhttps://agentprime.io/advisories/CVE-2026-111816/https://agentprime.io/advisories/CVE-2026-111816/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 18:26:32 GMTCVEcriticalCVE-2025-55702: Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requesthttps://agentprime.io/advisories/CVE-2025-55702/https://agentprime.io/advisories/CVE-2025-55702/CVSS 7.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 18:24:21 GMTCVECVE-2025-31699: Apache Traffic Server: Origin connection still owed a request body is reused, enabling request smugglinghttps://agentprime.io/advisories/CVE-2025-31699/https://agentprime.io/advisories/CVE-2025-31699/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 18:22:28 GMTCVEcriticalCVE-2026-86146: Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsinghttps://agentprime.io/advisories/CVE-2026-86146/https://agentprime.io/advisories/CVE-2026-86146/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 12:15:26 GMTCVEAIOHTTP: Pure-Python parser request smugglinghttps://agentprime.io/advisories/GHSA-pqxq-w44r-73xw/https://agentprime.io/advisories/GHSA-pqxq-w44r-73xw/aiohttp <3.14.4, fixed in 3.14.4. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 20 Oct 2026 19:52:21 GMTPyPIaiohttpCVE-2026-93003: NetX Duo Web HTTP server interprets request body content as HTTP header fieldshttps://agentprime.io/advisories/CVE-2026-93003/https://agentprime.io/advisories/CVE-2026-93003/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 20 Oct 2026 15:24:53 GMTCVEPingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentshttps://agentprime.io/advisories/GHSA-vx4q-2c55-cvmg/https://agentprime.io/advisories/GHSA-vx4q-2c55-cvmg/pingora-proxy >=0.0.0-0, <0.9.0, fixed in 0.9.0. CVSS 8.7 (High). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 20 Oct 2026 12:00:00 GMTcrates.iopingora-proxyPingora HTTP/2 :authority and Host header mismatch enables cache poisoning and host-based access control bypasshttps://agentprime.io/advisories/GHSA-mgg9-6xw2-jfgp/https://agentprime.io/advisories/GHSA-mgg9-6xw2-jfgp/pingora-core >=0.0.0-0, <0.9.0, fixed in 0.9.0. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 20 Oct 2026 12:00:00 GMTcrates.iopingora-core`wasi-http`: Guests can add conflicting content lengths to messageshttps://agentprime.io/advisories/GHSA-r8xh-cgf7-392j/https://agentprime.io/advisories/GHSA-r8xh-cgf7-392j/wasmtime-wasi-http >=0.0.0-0, <36.0.19 || >=37.0.0, <48.0.7 || >=49.0.0, <49.0.4, fixed in 36.0.19, 48.0.7, 49.0.4. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 19 Oct 2026 12:00:00 GMTcrates.iowasmtime-wasi-http`wasi-http` p3: Guests can set incorrect content-length for spliced response bodieshttps://agentprime.io/advisories/GHSA-9prg-84vf-g5fc/https://agentprime.io/advisories/GHSA-9prg-84vf-g5fc/wasmtime-wasi-http >=46.0.0, <48.0.7 || >=49.0.0, <49.0.4, fixed in 48.0.7, 49.0.4. CVSS 6.9 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 19 Oct 2026 12:00:00 GMTcrates.iowasmtime-wasi-httpCVE-2026-57488: pupnp: Integer truncation in HTTP Content-Length parsing enables request smugglinghttps://agentprime.io/advisories/CVE-2026-57488/https://agentprime.io/advisories/CVE-2026-57488/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 15:34:49 GMTCVECVE-2026-102479: HTTP request smuggling in Eclipse Foundation Eclipse Vert.xhttps://agentprime.io/advisories/CVE-2026-102479/https://agentprime.io/advisories/CVE-2026-102479/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 18:43:54 GMTCVECVE-2026-88829: Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxyhttps://agentprime.io/advisories/CVE-2026-88829/https://agentprime.io/advisories/CVE-2026-88829/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 Oct 2026 10:00:42 GMTCVEMicrosoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerabilityhttps://agentprime.io/advisories/GHSA-rv87-ccxw-8ggf/https://agentprime.io/advisories/GHSA-rv87-ccxw-8ggf/Microsoft.AspNetCore.App.Runtime.linux-arm >=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2, fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2. CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 13 Oct 2026 20:40:50 GMTNuGetMicrosoft.AspNetCore.App.Runtime.linux-armMicrosoft.AspNetCore.App.Runtime.linux-arm64Microsoft.AspNetCore.App.Runtime.linux-musl-armMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64Microsoft.AspNetCore.App.Runtime.linux-musl-x64Microsoft.AspNetCore.App.Runtime.linux-x64Microsoft.AspNetCore.App.Runtime.osx-arm64Microsoft.AspNetCore.App.Runtime.osx-x64Microsoft.AspNetCore.App.Runtime.win-arm64Microsoft.AspNetCore.App.Runtime.win-x64Microsoft.AspNetCore.App.Runtime.win-x86criticalMicrosoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerabilityhttps://agentprime.io/advisories/GHSA-fpq8-4vhr-rcxx/https://agentprime.io/advisories/GHSA-fpq8-4vhr-rcxx/Microsoft.AspNetCore.App.Runtime.linux-arm >=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2, fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2. CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 13 Oct 2026 20:37:27 GMTNuGetMicrosoft.AspNetCore.App.Runtime.linux-armMicrosoft.AspNetCore.App.Runtime.linux-arm64Microsoft.AspNetCore.App.Runtime.linux-musl-armMicrosoft.AspNetCore.App.Runtime.linux-musl-arm64Microsoft.AspNetCore.App.Runtime.linux-musl-x64Microsoft.AspNetCore.App.Runtime.linux-x64Microsoft.AspNetCore.App.Runtime.osx-arm64Microsoft.AspNetCore.App.Runtime.osx-x64Microsoft.AspNetCore.App.Runtime.win-arm64Microsoft.AspNetCore.App.Runtime.win-x64Microsoft.AspNetCore.App.Runtime.win-x86criticalCVE-2026-61642: Squid Request Smuggling in HTTP Transfer-Encodinghttps://agentprime.io/advisories/CVE-2026-61642/https://agentprime.io/advisories/CVE-2026-61642/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 13 Oct 2026 16:29:37 GMTCVEHTTP/1 server connection desynchronization after 2xx CONNECT response in net/httphttps://agentprime.io/advisories/GO-2026-6613/https://agentprime.io/advisories/GO-2026-6613/stdlib <1.26.9 || >=1.27.0-0, <1.27.2, fixed in 1.26.9, 1.27.2. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.Thu, 08 Oct 2026 22:31:09 GMTGostdlibHTTP/2 transport accepts malformed framing-related headers in net/httphttps://agentprime.io/advisories/GO-2026-6610/https://agentprime.io/advisories/GO-2026-6610/golang.org/x/net <0.60.0, fixed in 0.60.0. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.Thu, 08 Oct 2026 22:31:09 GMTGogolang.org/x/netstdlibHTTP/1 client connection desynchronization after CONNECT rejection in net/httphttps://agentprime.io/advisories/GO-2026-6605/https://agentprime.io/advisories/GO-2026-6605/stdlib <1.26.9 || >=1.27.0-0, <1.27.2, fixed in 1.26.9, 1.27.2. CVSS 7.5 (High). Published by OSV. Not analysed by agentprime yet.Thu, 08 Oct 2026 22:31:09 GMTGostdlibCVE-2026-77803: Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classichttps://agentprime.io/advisories/CVE-2026-77803/https://agentprime.io/advisories/CVE-2026-77803/CVSS 3.6 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 12:39:36 GMTCVECVE-2026-77802: HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classichttps://agentprime.io/advisories/CVE-2026-77802/https://agentprime.io/advisories/CVE-2026-77802/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 12:38:58 GMTCVECVE-2026-63718: Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smugglinghttps://agentprime.io/advisories/CVE-2026-63718/https://agentprime.io/advisories/CVE-2026-63718/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 16:17:06 GMTCVECVE-2026-103399: Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue bodyhttps://agentprime.io/advisories/CVE-2026-103399/https://agentprime.io/advisories/CVE-2026-103399/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Sep 2026 17:42:31 GMTCVEundici vulnerable to downstream response splitting via retry interceptorhttps://agentprime.io/advisories/GHSA-r53p-7pc4-xj5r/https://agentprime.io/advisories/GHSA-r53p-7pc4-xj5r/undici <6.28.1 || >=7.0.0, <7.29.1 || >=8.0.0, <8.10.2, fixed in 6.28.1, 7.29.1, 8.10.2. CVSS 3.7 (Low). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Tue, 29 Sep 2026 18:22:07 GMTnpmundiciMint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediarieshttps://agentprime.io/advisories/GHSA-gvrc-75rc-7gj9/https://agentprime.io/advisories/GHSA-gvrc-75rc-7gj9/mint >=0.1.0, <1.10.2, fixed in 1.10.2. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Mon, 28 Sep 2026 11:15:30 GMTHexmintCVE-2026-88773: HTTP Request Smugglinghttps://agentprime.io/advisories/CVE-2026-88773/https://agentprime.io/advisories/CVE-2026-88773/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sun, 27 Sep 2026 16:20:08 GMTCVEcriticalCVE-2026-100666: Netty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodechttps://agentprime.io/advisories/CVE-2026-100666/https://agentprime.io/advisories/CVE-2026-100666/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:31 GMTCVECVE-2026-100659: Netty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypasshttps://agentprime.io/advisories/CVE-2026-100659/https://agentprime.io/advisories/CVE-2026-100659/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Sep 2026 13:23:26 GMTCVECVE-2026-86350: Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-uphttps://agentprime.io/advisories/CVE-2026-86350/https://agentprime.io/advisories/CVE-2026-86350/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 11:31:36 GMTCVEcriticalCVE-2026-77756: Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requestshttps://agentprime.io/advisories/CVE-2026-77756/https://agentprime.io/advisories/CVE-2026-77756/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 11:18:02 GMTCVECVE-2026-73548: Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend poolhttps://agentprime.io/advisories/CVE-2026-73548/https://agentprime.io/advisories/CVE-2026-73548/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 19:35:15 GMTCVEUnvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connectionshttps://agentprime.io/advisories/GHSA-rj5m-69wp-cxq9/https://agentprime.io/advisories/GHSA-rj5m-69wp-cxq9/mint >=0.1.0, <1.10.1, fixed in 1.10.1. CVSS 6.3 (Medium). Published by the GitHub Advisory Database. Not analysed by agentprime yet.Sat, 19 Sep 2026 17:00:31 GMTHexmintCVE-2026-93574: Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsinghttps://agentprime.io/advisories/CVE-2026-93574/https://agentprime.io/advisories/CVE-2026-93574/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 20:12:43 GMTCVECVE-2026-11722: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smugglinghttps://agentprime.io/advisories/CVE-2026-11722/https://agentprime.io/advisories/CVE-2026-11722/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:14:34 GMTCVECVE-2026-11710: IBM WebSphere Application Server is affected by an HTTP request smuggling vulnerabilityhttps://agentprime.io/advisories/CVE-2026-11710/https://agentprime.io/advisories/CVE-2026-11710/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:08:09 GMTCVECVE-2026-11548: IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smugglinghttps://agentprime.io/advisories/CVE-2026-11548/https://agentprime.io/advisories/CVE-2026-11548/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Sep 2026 19:05:48 GMTCVE