CWE-444 · Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) (page 2)
Page 2 of 4 — CVEs classified under CWE-444, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41082 | | 2026-01-26 | Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Kee… | |
CVE-2026-1002 | Medium | 5.3 | 2026-01-15 | The Vert.x Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request UR… |
CVE-2026-23527 | High | 8.9 | 2026-01-15 | H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRaw… |
CVE-2025-69225 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals… |
CVE-2025-69224 | Medium | 6.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggli… |
CVE-2025-12874 | | 2025-12-19 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Quest Coexistence Manager for Notes (Free/Busy Connector modu… | |
CVE-2023-53878 | | 2025-12-15 | Member Login Script 3.3 contains a client-side desynchronization vulnerability that allows attackers to manipulate HTTP request handling by exploiting Content-… | |
CVE-2025-14523 | High | 8.2 | 2025-12-11 | A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front pr… |
CVE-2025-61258 | High | 7.5 | 2025-12-09 | Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: th… |
CVE-2025-66373 | Medium | 4.8 | 2025-12-04 | Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Gh… |
CVE-2025-12642 | Critical | 9.1 | 2025-11-03 | lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attac… |
CVE-2025-11915 | | 2025-10-22 | Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28… | |
CVE-2025-55315 | Critical | 9.9 | 2025-10-14 | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature ove… |
CVE-2025-61884 | High | 7.5 | 2025-10-12 | Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-59822 | High | 7.5 | 2025-09-23 | Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling… |
CVE-2025-6999 | | 2025-09-15 | An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sa… | |
CVE-2025-56266 | Critical | 9.8 | 2025-09-08 | A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. |
CVE-2025-58056 | High | 7.5 | 2025-09-03 | Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions… |
CVE-2025-58068 | Critical | 9.1 | 2025-08-29 | Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improp… |
CVE-2025-54142 | Medium | 4.0 | 2025-08-29 | Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within t… |
CVE-2025-32094 | Medium | 4.0 | 2025-08-07 | An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTION… |
CVE-2025-52892 | Medium | 4.5 | 2025-08-05 | EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a use… |
CVE-2025-53643 | High | 7.5 | 2025-07-14 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smugglin… |
CVE-2025-53628 | High | 8.8 | 2025-07-10 | cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitt… |
CVE-2025-49826 | High | 7.5 | 2025-07-03 | Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Deni… |
CVE-2025-49005 | Low | 3.7 | 2025-07-03 | Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0… |
CVE-2025-6442 | Medium | 5.9 | 2025-06-25 | Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected instal… |
CVE-2025-41235 | High | 8.6 | 2025-05-30 | Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies. |
CVE-2025-4366 | Medium | 6.1 | 2025-05-22 | A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated… |
CVE-2025-23167 | Medium | 6.5 | 2025-05-19 | A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables… |
CVE-2025-4600 | High | 7.5 | 2025-05-16 | A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This… |
CVE-2025-47905 | Medium | 5.4 | 2025-05-13 | Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product inc… |
CVE-2024-56523 | Critical | 9.1 | 2025-05-12 | Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request bo… |
CVE-2025-43859 | Critical | 9.1 | 2025-04-24 | h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead… |
CVE-2024-33452 | High | 7.7 | 2025-04-22 | An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. |
CVE-2024-29643 | Critical | 9.1 | 2025-04-18 | An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component. |
CVE-2025-1386 | Medium | 4.9 | 2025-04-11 | When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker… |
CVE-2024-53868 | High | 7.5 | 2025-04-03 | Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, fro… |
CVE-2025-31137 | High | 7.5 | 2025-04-01 | React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all R… |
CVE-2022-39163 | Medium | 4.7 | 2025-03-26 | IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connect… |
CVE-2025-30346 | Medium | 5.4 | 2025-03-21 | Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. |
CVE-2024-6827 | High | 7.5 | 2025-03-20 | Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fa… |
CVE-2024-10264 | Critical | 9.8 | 2025-03-20 | HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP reques… |
CVE-2025-29904 | Medium | 5.3 | 2025-03-12 | In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible |
CVE-2025-1867 | | 2025-03-03 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affec… | |
CVE-2024-56908 | Medium | 6.8 | 2025-02-13 | In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input… |
CVE-2025-0752 | High | 7.1 | 2025-01-28 | A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be… |
CVE-2023-29476 | Critical | 9.1 | 2024-12-14 | In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. This is fixed in 2.8… |
CVE-2024-12397 | High | 7.4 | 2024-12-12 | A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an att… |
CVE-2024-53008 | Medium | 5.3 | 2024-11-28 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacke… |
CVE-2024-9666 | Medium | 4.7 | 2024-11-25 | A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy heade… |
CVE-2024-52304 | High | 7.5 | 2024-11-18 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions… |
CVE-2023-4639 | High | 7.4 | 2024-11-17 | A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacke… |
CVE-2024-52530 | High | 7.5 | 2024-11-11 | GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transf… |
CVE-2024-49768 | Critical | 9.1 | 2024-10-29 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, fo… |
CVE-2024-44775 | High | 7.5 | 2024-10-15 | kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially c… |
CVE-2024-21281 | Medium | 5.3 | 2024-10-15 | Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version… |
CVE-2024-8912 | High | 7.5 | 2024-10-11 | An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Look… |
CVE-2024-9622 | Medium | 5.3 | 2024-10-08 | A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling req… |
CVE-2024-8925 | Low | 3.1 | 2024-10-08 | In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could… |
CVE-2024-34535 | Medium | 5.9 | 2024-10-03 | In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header. |
CVE-2024-45614 | Medium | 5.4 | 2024-09-19 | Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) b… |
CVE-2024-42342 | Medium | 4.3 | 2024-09-08 | Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
CVE-2024-27185 | Critical | 9.1 | 2024-08-20 | The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors. |
CVE-2024-35538 | Medium | 5.3 | 2024-08-19 | Typecho v1.3.0 was discovered to contain a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses by specifying an arbitrary IP… |
CVE-2024-41671 | High | 8.3 | 2024-07-29 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipeli… |
CVE-2024-35161 | High | 7.5 | 2024-07-26 | Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poi… |
CVE-2023-38522 | High | 7.5 | 2024-07-26 | Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for… |
CVE-2024-41110 | Critical | 9.9 | 2024-07-24 | Moby is an open-source project created by Docker for software containerization. A security vulnerability has been detected in certain versions of Docker Engine… |
CVE-2024-38494 | | 2024-07-15 | This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafte… | |
CVE-2016-15039 | Medium | 6.3 | 2024-07-11 | A vulnerability classified as critical was found in mhuertos phpLDAPadmin up to 665dbc2690ebeb5392d38f1fece0a654225a0b38. Affected by this vulnerability is the… |
CVE-2024-22279 | Medium | 5.9 | 2024-06-10 | Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Clou… |
CVE-2024-23326 | Medium | 5.9 | 2024-06-04 | Envoy is a cloud-native, open source edge and service proxy. A theoretical request smuggling vulnerability exists through Envoy if a server can be tricked into… |
CVE-2024-23316 | | 2024-05-31 | HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header reque… | |
CVE-2024-34350 | High | 7.5 | 2024-05-14 | Next.js is a React framework that can provide building blocks to create web applications. Prior to 13.5.1, an inconsistent interpretation of a crafted HTTP req… |
CVE-2024-27982 | Medium | 6.5 | 2024-05-07 | The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggl… |
CVE-2024-32638 | Medium | 6.3 | 2024-05-02 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apac… |
CVE-2024-21088 | High | 7.5 | 2024-04-16 | Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite (component: Import Utility). Supported versions that are affected are 12… |
CVE-2024-1135 | High | 7.5 | 2024-04-16 | Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting T… |
CVE-2024-24795 | Medium | 6.3 | 2024-04-04 | HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to ca… |
CVE-2024-27922 | Critical | 9.8 | 2024-03-21 | TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp… |
CVE-2024-22081 | Critical | 9.8 | 2024-03-20 | An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsin… |
CVE-2023-50811 | Medium | 6.5 | 2024-03-19 | An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a specific reception… |
CVE-2024-27439 | Medium | 6.5 | 2024-03-19 | An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9… |
CVE-2023-51747 | High | 7.1 | 2024-02-27 | Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of in… |
CVE-2024-20915 | Medium | 5.3 | 2024-02-17 | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 1… |
CVE-2024-23452 | High | 7.5 | 2024-02-08 | Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description… |
CVE-2024-23829 | Medium | 6.5 | 2024-01-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences i… |
CVE-2023-52354 | High | 7.5 | 2024-01-22 | chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted. |
CVE-2024-21647 | Medium | 5.9 | 2024-01-08 | Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer… |
CVE-2023-51701 | Medium | 5.3 | 2024-01-08 | fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could mis… |
CVE-2023-49584 | Medium | 4.3 | 2023-12-12 | SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTT… |
CVE-2023-46589 | High | 7.5 | 2023-11-28 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82… |
CVE-2023-48365 | Critical | 9.6 | 2023-11-15 | Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP hea… |
CVE-2023-46121 | Medium | 5.0 | 2023-11-15 | yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a r… |
CVE-2023-47641 | Low | 3.4 | 2023-11-14 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the incons… |
CVE-2023-47627 | Medium | 5.3 | 2023-11-14 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which cou… |
CVE-2023-46846 | Critical | 9.3 | 2023-11-03 | SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall… |
CVE-2023-46137 | Medium | 5.3 | 2023-10-25 | Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web… |
CVE-2023-30910 | Medium | 5.4 | 2023-10-09 | HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. |