CWE-444 · Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) (page 3)
Page 3 of 4 — CVEs classified under CWE-444, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41265 | Critical | 9.6 | 2023-08-29 | An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier… |
CVE-2023-40175 | High | 7.3 | 2023-08-18 | Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encodi… |
CVE-2023-40225 | High | 7.2 | 2023-08-10 | HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, and 2.8.x before 2… |
CVE-2023-33934 | Critical | 9.1 | 2023-08-09 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. |
CVE-2023-38697 | Medium | 5.8 | 2023-08-04 | protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extensio… |
CVE-2023-34037 | Medium | 5.3 | 2023-08-04 | VMware Horizon Server contains a HTTP request smuggling vulnerability. A malicious actor with network access may be able to perform HTTP smuggle requests. |
CVE-2023-35944 | High | 8.2 | 2023-07-25 | Envoy is an open source edge and service proxy designed for cloud-native applications. Envoy allows mixed-case schemes in HTTP/2, however, some internal scheme… |
CVE-2023-37276 | Medium | 5.3 | 2023-07-19 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is u… |
CVE-2023-33987 | High | 8.6 | 2023-07-11 | An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88… |
CVE-2023-26137 | High | 7.2 | 2023-07-06 | All versions of the package drogonframework/drogon are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values in the ad… |
CVE-2023-33193 | Critical | 9.1 | 2023-05-30 | Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewin… |
CVE-2023-27238 | Critical | 9.8 | 2023-05-12 | LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. |
CVE-2023-25950 | High | 7.3 | 2023-04-11 | HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a… |
CVE-2023-27493 | High | 8.1 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, Envoy does… |
CVE-2023-27491 | Medium | 5.4 | 2023-04-04 | Envoy is an open source edge and service proxy designed for cloud-native applications. Compliant HTTP/1 service should reject malformed request lines. Prior to… |
CVE-2023-29141 | Critical | 9.8 | 2023-03-31 | An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-… |
CVE-2023-27522 | High | 7.5 | 2023-03-07 | HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special ch… |
CVE-2023-25690 | Critical | 9.8 | 2023-03-07 | Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when m… |
CVE-2023-25725 | Critical | 9.1 | 2023-02-14 | HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situations, aka "request smuggling." The HTTP h… |
CVE-2023-23691 | High | 8.1 | 2023-01-20 | Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this… |
CVE-2022-36760 | Critical | 9.0 | 2023-01-17 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2022-41721 | High | 7.5 | 2023-01-13 | A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the serv… |
CVE-2022-35256 | Medium | 6.5 | 2022-12-05 | The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request… |
CVE-2022-38114 | Medium | 6.1 | 2022-11-23 | This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS. |
CVE-2022-45059 | High | 7.5 | 2022-11-09 | An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by reque… |
CVE-2022-42252 | High | 7.5 | 2022-11-01 | If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rej… |
CVE-2022-2880 | High | 7.5 | 2022-10-14 | Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could… |
CVE-2022-21826 | Medium | 5.4 | 2022-09-30 | Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the req… |
CVE-2022-2466 | Critical | 9.8 | 2022-08-31 | It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior. |
CVE-2022-33988 | High | 7.5 | 2022-08-15 | dproxy-nexgen (aka dproxy nexgen) re-uses the DNS transaction id (TXID) value from client queries, which allows attackers (able to send queries to the resolver… |
CVE-2022-1705 | Medium | 6.5 | 2022-08-10 | Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined… |
CVE-2022-20713 | Medium | 4.3 | 2022-08-10 | A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2022-25763 | High | 7.5 | 2022-08-10 | Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. Thi… |
CVE-2022-31109 | High | 7.2 | 2022-08-01 | laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications tha… |
CVE-2022-32215 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead… |
CVE-2022-32214 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can le… |
CVE-2022-32213 | Medium | 6.5 | 2022-07-14 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead… |
CVE-2021-46825 | Critical | 9.1 | 2022-07-07 | Symantec Advanced Secure Gateway (ASG) and ProxySG are susceptible to an HTTP desync vulnerability. When a remote unauthenticated attacker and other web client… |
CVE-2022-31081 | High | 7.3 | 2022-06-27 | HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain… |
CVE-2022-26377 | High | 7.5 | 2022-06-09 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2022-29361 | Critical | 9.8 | 2022-05-25 | Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTTP request with mul… |
CVE-2022-0552 | Medium | 5.9 | 2022-04-11 | A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was… |
CVE-2022-24801 | High | 8.1 | 2022-04-04 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in… |
CVE-2022-24790 | Critical | 9.1 | 2022-03-30 | Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate tha… |
CVE-2021-25220 | Medium | 6.8 | 2022-03-23 | BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 e… |
CVE-2022-24766 | Critical | 9.8 | 2022-03-21 | mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smu… |
CVE-2022-24761 | High | 7.5 | 2022-03-17 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. When using Waitress versions 2.1.0 and prior behind a proxy that does not properly valida… |
CVE-2022-22720 | Critical | 9.8 | 2022-03-14 | Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Re… |
CVE-2022-22536 | Critical | 10.0 | 2022-02-09 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for… |
CVE-2022-22532 | Critical | 9.8 | 2022-02-09 | In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthentic… |
CVE-2021-41442 | High | 7.5 | 2022-02-09 | An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to DoS the web application… |
CVE-2021-42791 | High | 7.3 | 2022-01-28 | An issue was discovered in VeridiumID VeridiumAD 2.5.3.0. The HTTP request to trigger push notifications for VeridiumAD enrolled users does not enforce proper… |
CVE-2022-23959 | Critical | 9.1 | 2022-01-26 | In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0… |
CVE-2022-22691 | Medium | 6.8 | 2022-01-18 | The password reset component deployed within Umbraco uses the hostname supplied within the request host header when building a password reset URL. It may be po… |
CVE-2022-22690 | High | 8.6 | 2022-01-18 | Within the Umbraco CMS, a configuration element named "UmbracoApplicationUrl" (or just "ApplicationUrl") is used whenever application code needs to build a URL… |
CVE-2021-45468 | Critical | 9.8 | 2022-01-14 | Imperva Web Application Firewall (WAF) before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls… |
CVE-2021-41451 | High | 7.5 | 2021-12-17 | A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1_211117 allows a remote unauthenticated attacker to send a speciall… |
CVE-2021-43797 | Medium | 6.5 | 2021-12-09 | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty pr… |
CVE-2021-41450 | High | 7.5 | 2021-12-08 | An HTTP request smuggling attack in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific… |
CVE-2021-37253 | High | 7.5 | 2021-12-05 | M-Files Web before 20.10.9524.1 allows a denial of service via overlapping ranges (in HTTP requests with crafted Range or Request-Range headers). NOTE: this is… |
CVE-2021-41267 | Medium | 6.5 | 2021-11-24 | Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers th… |
CVE-2021-41436 | High | 7.5 | 2021-11-19 | An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, RT-AX82U GUNDAM EDI… |
CVE-2021-43669 | High | 7.5 | 2021-11-18 | A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This b… |
CVE-2021-22959 | Medium | 6.5 | 2021-11-15 | The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4… |
CVE-2021-43610 | High | 7.5 | 2021-11-12 | Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated S… |
CVE-2021-22960 | Medium | 6.5 | 2021-11-03 | The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS… |
CVE-2021-37147 | High | 7.5 | 2021-11-03 | Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Se… |
CVE-2021-29991 | High | 8.1 | 2021-11-03 | Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers… |
CVE-2021-41136 | Low | 3.7 | 2021-10-12 | Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP header values which cont… |
CVE-2021-41732 | High | 7.5 | 2021-09-29 | An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE… |
CVE-2021-31923 | Medium | 5.3 | 2021-09-24 | Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation. |
CVE-2021-39214 | High | 8.1 | 2021-09-16 | mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smu… |
CVE-2021-38162 | High | 8.9 | 2021-09-14 | SAP Web Dispatcher versions - 7.49, 7.53, 7.77, 7.81, KRNL64NUC - 7.22, 7.22EXT, 7.49, KRNL64UC -7.22, 7.22EXT, 7.49, 7.53, KERNEL - 7.22, 7.49, 7.53, 7.77, 7… |
CVE-2021-34559 | Medium | 5.4 | 2021-08-31 | In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.8 a vulnerability may allow remote attackers to rewrite links and URLs in cached pages to arbitrary strings. |
CVE-2021-33056 | High | 7.5 | 2021-08-12 | Belledonne Belle-sip before 4.5.20, as used in Linphone and other products, can crash via an invalid From header in a SIP message. |
CVE-2021-38512 | High | 7.5 | 2021-08-10 | An issue was discovered in the actix-http crate before 3.0.0-beta.9 for Rust. HTTP/1 request smuggling (aka HRS) can occur, potentially leading to credential d… |
CVE-2021-32598 | Medium | 4.3 | 2021-08-05 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability In FortiManager and FortiAnalyzer GUI 7.0.0, 6.4.6 and b… |
CVE-2021-36740 | Medium | 6.5 | 2021-07-14 | Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Va… |
CVE-2021-33683 | Medium | 4.3 | 2021-07-14 | SAP Web Dispatcher and Internet Communication Manager (ICM), versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NU… |
CVE-2021-33037 | Medium | 5.3 | 2021-07-12 | Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstanc… |
CVE-2021-32715 | Low | 3.1 | 2021-07-07 | hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a `Content-Length` header with a pre… |
CVE-2021-32565 | High | 7.5 | 2021-06-29 | Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0… |
CVE-2021-27577 | High | 7.5 | 2021-06-29 | Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0… |
CVE-2019-17567 | Medium | 5.3 | 2021-06-10 | Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the who… |
CVE-2021-30180 | Critical | 9.8 | 2021-06-01 | Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers wh… |
CVE-2021-31922 | High | 7.5 | 2021-05-14 | An HTTP Request Smuggling vulnerability in Pulse Secure Virtual Traffic Manager before 21.1 could allow an attacker to smuggle an HTTP request through an HTTP/… |
CVE-2021-21409 | Medium | 5.9 | 2021-03-30 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2020-25097 | High | 8.6 | 2021-03-19 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smugg… |
CVE-2021-21295 | Medium | 5.9 | 2021-03-09 | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clie… |
CVE-2021-20220 | Medium | 4.8 | 2021-02-23 | A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1… |
CVE-2021-23339 | Medium | 5.0 | 2021-02-17 | This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers. |
CVE-2021-23336 | Medium | 5.9 | 2021-02-15 | The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to W… |
CVE-2021-21299 | Medium | 4.8 | 2021-02-11 | hyper is an open-source HTTP library for Rust (crates.io). In hyper from version 0.12.0 and before versions 0.13.10 and 0.14.3 there is a vulnerability that ca… |
CVE-2021-22293 | High | 7.5 | 2021-02-06 | Some Huawei products have an inconsistent interpretation of HTTP requests vulnerability. Attackers can exploit this vulnerability to cause information leak. Af… |
CVE-2021-25762 | Medium | 5.3 | 2021-02-03 | In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible. |
CVE-2020-28483 | High | 7.1 | 2021-01-20 | This affects all versions of package github.com/gin-gonic/gin. When gin is exposed directly to the internet, a client's IP can be spoofed by setting the X-Forw… |
CVE-2020-28473 | Medium | 6.8 | 2021-01-18 | The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate… |
CVE-2021-21445 | Medium | 5.4 | 2021-01-12 | SAP Commerce Cloud, versions - 1808, 1811, 1905, 2005, 2011, allows an authenticated attacker to include invalidated data in the HTTP response Content Type hea… |
CVE-2020-17509 | High | 7.5 | 2021-01-11 | ATS negative cache option is vulnerable to a cache poisoning attack. If you have this option enabled, please upgrade or disable this feature. Apache Traffic Se… |
CVE-2020-8287 | Medium | 6.5 | 2021-01-06 | Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fiel… |