CWE-444
AllowedInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Abstraction: Base · Status: Incomplete
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
627 vulnerabilities reference this CWE, most recent first.
GHSA-M9F2-W9FV-J46G
Vulnerability from github – Published: 2024-07-15 15:31 – Updated: 2024-07-15 15:31This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.
{
"affected": [],
"aliases": [
"CVE-2024-38494"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-15T14:15:03Z",
"severity": "HIGH"
},
"details": "This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request.",
"id": "GHSA-m9f2-w9fv-j46g",
"modified": "2024-07-15T15:31:00Z",
"published": "2024-07-15T15:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38494"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24678"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MCFM-H73V-635M
Vulnerability from github – Published: 2018-10-19 16:55 – Updated: 2022-09-14 19:18It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.31"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.undertow:undertow-core"
},
"ranges": [
{
"events": [
{
"introduced": "1.4.0"
},
{
"fixed": "1.4.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-2666"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:45:55Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.",
"id": "GHSA-mcfm-h73v-635m",
"modified": "2022-09-14T19:18:03Z",
"published": "2018-10-19T16:55:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2666"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-mcfm-h73v-635m"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Undertow-core vulnerable to HTTP Request Smuggling"
}
GHSA-MFGQ-FWJQ-XX5P
Vulnerability from github – Published: 2026-09-01 21:31 – Updated: 2026-09-01 21:31Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
{
"affected": [],
"aliases": [
"CVE-2026-78605"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-01T20:17:23Z",
"severity": "MODERATE"
},
"details": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027) (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.",
"id": "GHSA-mfgq-fwjq-xx5p",
"modified": "2026-09-01T21:31:50Z",
"published": "2026-09-01T21:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78605"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MFJX-W835-F3W2
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2022-05-13 01:27Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the path option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.
{
"affected": [],
"aliases": [
"CVE-2018-12116"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-28T17:29:00Z",
"severity": "HIGH"
},
"details": "Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option of an HTTP request, then data can be provided which will trigger a second, unexpected, and user-defined HTTP request to made to the same server.",
"id": "GHSA-mfjx-w835-f3w2",
"modified": "2022-05-13T01:27:48Z",
"published": "2022-05-13T01:27:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12116"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1821"
},
{
"type": "WEB",
"url": "https://nodejs.org/en/blog/vulnerability/november-2018-security-releases"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202003-48"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MFX4-HV73-Q22V
Vulnerability from github – Published: 2026-08-03 20:46 – Updated: 2026-08-03 20:47Summary
The HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.
Impact
If using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.
Patch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.14.1"
},
"package": {
"ecosystem": "PyPI",
"name": "aiohttp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-69243"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-03T20:46:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades.\n\n### Impact\n\nIf using the server-side component, it may be possible for an attacker to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. AIOHTT is unaware of any public exploit code.\n\n---\n\nPatch: https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98",
"id": "GHSA-mfx4-hv73-q22v",
"modified": "2026-08-03T20:47:08Z",
"published": "2026-08-03T20:46:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-mfx4-hv73-q22v"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/pull/13017"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/commit/6ae358f0983c3f4d6f67692b2f8e65dc8e091c98"
},
{
"type": "PACKAGE",
"url": "https://github.com/aio-libs/aiohttp"
},
{
"type": "WEB",
"url": "https://github.com/aio-libs/aiohttp/releases/tag/v3.14.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "AIOHTTP: HTTP request smuggling via WebSocket upgrade"
}
GHSA-MGC4-WQV7-4PXM
Vulnerability from github – Published: 2023-05-18 17:29 – Updated: 2023-05-18 17:29Impact
Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.
This vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the NIOHTTP1 module.
Workarounds
No workaround is available, users must upgrade.
References
https://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605
{
"affected": [
{
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/apple/swift-nio"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.14.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "SwiftURL",
"name": "github.com/apple/swift-nio"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.13.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2023-05-18T17:29:43Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Impact\n\nAffected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures of authentication, routing, and other issues.\n\nThis vulnerability can be found in the bundled copy of the Node.JS HTTP parser used in the `NIOHTTP1` module.\n\n### Workarounds\n\nNo workaround is available, users must upgrade.\n\n### References\n\nhttps://nodejs.org/en/blog/vulnerability/february-2020-security-releases/#http-request-smuggling-using-malformed-transfer-encoding-header-critical-cve-2019-15605",
"id": "GHSA-mgc4-wqv7-4pxm",
"modified": "2023-05-18T17:29:43Z",
"published": "2023-05-18T17:29:43Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/security/advisories/GHSA-mgc4-wqv7-4pxm"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/pull/1387"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/pull/1388"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/commit/8da5c5a4e6c5084c296b9f39dc54f00be146e0fa"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/commit/bfde40cac8eca25ce021552513b20ee23fc6e306"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/commit/df9390006bce7da1b6273f804d3acbbfdfcc6154"
},
{
"type": "WEB",
"url": "https://github.com/apple/swift-nio/commit/f94b22b506e3557cb1b325534fa9bbcd39c90246"
},
{
"type": "PACKAGE",
"url": "https://github.com/apple/swift-nio"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header"
}
GHSA-MH87-C4C3-CGWF
Vulnerability from github – Published: 2026-04-07 12:31 – Updated: 2026-04-07 12:31Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass.
{
"affected": [],
"aliases": [
"CVE-2026-31842"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-07T12:16:21Z",
"severity": "HIGH"
},
"details": "Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer() function uses strcmp() to compare the header value against \"chunked\", even though RFC 7230 specifies that transfer-coding names are case-insensitive. By sending a request with Transfer-Encoding: Chunked, an unauthenticated remote attacker can cause Tinyproxy to misinterpret the request as having no body. In this state, Tinyproxy sets content_length.client to -1, skips pull_client_data_chunked(), forwards request headers upstream, and transitions into relay_connection() raw TCP forwarding while unread body data remains buffered. This leads to inconsistent request state between Tinyproxy and backend servers. RFC-compliant backends (e.g., Node.js, Nginx) will continue waiting for chunked body data, causing connections to hang indefinitely. This behavior enables application-level denial of service through backend worker exhaustion. Additionally, in deployments where Tinyproxy is used for request-body inspection, filtering, or security enforcement, the unread body may be forwarded without proper inspection, resulting in potential security control bypass.",
"id": "GHSA-mh87-c4c3-cgwf",
"modified": "2026-04-07T12:31:15Z",
"published": "2026-04-07T12:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31842"
},
{
"type": "WEB",
"url": "https://github.com/tinyproxy/tinyproxy/issues/604"
},
{
"type": "WEB",
"url": "https://datatracker.ietf.org/doc/html/rfc7230"
},
{
"type": "WEB",
"url": "https://github.com/tinyproxy/tinyproxy"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-MHVJ-JHPQ-885V
Vulnerability from github – Published: 2026-07-24 22:26 – Updated: 2026-08-12 21:12Summary
Five independent HTTP/1.1 conformance laxities in blaze's hand-written Java parser (http/src/main/java/org/http4s/blaze/http/parser/) cause request-boundary disagreement with a stricter intermediary. All are reachable from a default BlazeServerBuilder with no non-default configuration.
Impact
Actual exploitability depends on the fronting proxy — a boundary disagreement requires a pair of parsers that disagree. Where the proxy forwards the malformed bytes and derives a different message boundary, the consequences are the standard set: front-end ACL/auth bypass, response-queue poisoning on pooled backend connections, and cache poisoning. Risk concentrates on lenient or legacy intermediaries.
Workarounds
Deploy behind an RFC-strict reverse proxy (nginx, HAProxy, Envoy, ALB) that rejects or re-serializes malformed requests at the edge; this neutralizes most of these for deployments that cannot upgrade immediately.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.23.17"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:http4s-blaze-server_2.13"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.23.17"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:blaze-http_2.13"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.23.17"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:blaze-http_3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.0-M41"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:blaze-http_3"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0-M1"
},
{
"fixed": "1.0.0-M42"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.0.0-M41"
},
"package": {
"ecosystem": "Maven",
"name": "org.http4s:blaze-http_2.13"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0-M1"
},
{
"fixed": "1.0.0-M42"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-73494"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T22:26:27Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\n Five independent HTTP/1.1 conformance laxities in blaze\u0027s hand-written Java parser (`http/src/main/java/org/http4s/blaze/http/parser/`) cause request-boundary disagreement with a stricter intermediary. All are reachable from a default `BlazeServerBuilder` with no non-default configuration.\n\n### Impact\nActual exploitability depends on the fronting proxy \u2014 a boundary disagreement requires a *pair* of parsers that disagree. Where the proxy forwards the malformed bytes and derives a different message boundary, the consequences are the standard set: front-end ACL/auth bypass, response-queue poisoning on pooled backend connections, and cache poisoning. Risk concentrates on lenient or legacy intermediaries.\n\n### Workarounds\n Deploy behind an RFC-strict reverse proxy (nginx, HAProxy, Envoy, ALB) that rejects or re-serializes malformed requests at the edge; this neutralizes most of these for deployments that cannot upgrade immediately.",
"id": "GHSA-mhvj-jhpq-885v",
"modified": "2026-08-12T21:12:10Z",
"published": "2026-07-24T22:26:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/security/advisories/GHSA-mhvj-jhpq-885v"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/commit/e871ebb1d27f50c98fd56988526ce42d0fee74d6"
},
{
"type": "PACKAGE",
"url": "https://github.com/http4s/blaze"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"
},
{
"type": "WEB",
"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze\u0027s Java wire parser"
}
GHSA-MHW9-V228-5C8F
Vulnerability from github – Published: 2025-08-07 06:30 – Updated: 2025-08-07 06:30An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
{
"affected": [],
"aliases": [
"CVE-2025-32094"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-07T05:15:45Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an \"Expect: 100-continue\" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.",
"id": "GHSA-mhw9-v228-5c8f",
"modified": "2025-08-07T06:30:30Z",
"published": "2025-08-07T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32094"
},
{
"type": "WEB",
"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100"
},
{
"type": "WEB",
"url": "https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling"
},
{
"type": "WEB",
"url": "https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103"
},
{
"type": "WEB",
"url": "https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MHXQ-VJJQ-PCVF
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
{
"affected": [],
"aliases": [
"CVE-2021-22959"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-15T15:15:00Z",
"severity": "MODERATE"
},
"details": "The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp \u003c v2.1.4 and \u003c v6.0.6.",
"id": "GHSA-mhxq-vjjq-pcvf",
"modified": "2022-05-24T19:20:57Z",
"published": "2022-05-24T19:20:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22959"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1238709"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2022/dsa-5170"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Mitigation
Use only SSL communication.
Mitigation
Terminate the client session after each request.
Mitigation
Turn all pages to non-cacheable.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.