CWE-444 · Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) (page 4)
Page 4 of 4 — CVEs classified under CWE-444, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-35884 | Medium | 6.5 | 2020-12-31 | An issue was discovered in the tiny_http crate through 2020-06-16 for Rust. HTTP Request smuggling can occur via a malformed Transfer-Encoding header. |
CVE-2020-35863 | Critical | 9.8 | 2020-12-31 | An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations wit… |
CVE-2020-26281 | Medium | 6.8 | 2020-12-21 | async-h1 is an asynchronous HTTP/1.1 parser for Rust (crates.io). There is a request smuggling vulnerability in async-h1 before version 2.3.0. This vulnerabili… |
CVE-2020-28361 | Medium | 5.4 | 2020-11-18 | Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protecti… |
CVE-2020-26129 | Medium | 6.5 | 2020-11-16 | In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible. |
CVE-2020-7764 | Medium | 5.9 | 2020-11-08 | This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are n… |
CVE-2020-25613 | High | 7.5 | 2020-10-06 | An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked t… |
CVE-2020-10687 | Medium | 4.8 | 2020-09-23 | A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1… |
CVE-2020-8201 | High | 7.4 | 2020-09-18 | Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted… |
CVE-2020-15810 | Medium | 6.5 | 2020-09-02 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP an… |
CVE-2020-9490 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the serv… |
CVE-2020-11993 | High | 7.5 | 2020-08-07 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were m… |
CVE-2019-19326 | Medium | 5.9 | 2020-07-15 | Silverstripe CMS sites through 4.4.4 which have opted into HTTP Cache Headers on responses served by the framework's HTTP layer can be vulnerable to web cache… |
CVE-2020-15049 | Critical | 9.9 | 2020-06-30 | An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed aga… |
CVE-2019-20866 | Medium | 5.3 | 2020-06-19 | An issue was discovered in Mattermost Server before 5.12.0. Use of a Proxy HTTP header, rather than the source address in an IP packet header, for obtaining IP… |
CVE-2018-21245 | Critical | 9.1 | 2020-06-15 | Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711. |
CVE-2020-7671 | High | 7.5 | 2020-06-10 | goliath through 1.0.6 allows request smuggling attacks where goliath is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct… |
CVE-2020-7670 | High | 7.5 | 2020-06-10 | agoo prior to 2.14.0 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. HTTP pipelining issues and re… |
CVE-2020-7659 | High | 7.5 | 2020-06-01 | reel through 0.6.1 allows Request Smuggling attacks due to incorrect Content-Length and Transfer encoding header parsing. It is possible to conduct HTTP reques… |
CVE-2020-10719 | Medium | 6.5 | 2020-05-26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an atta… |
CVE-2020-7658 | Medium | 6.1 | 2020-05-22 | meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Conten… |
CVE-2020-11077 | Medium | 6.8 | 2020-05-22 | In Puma (RubyGem) before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown clien… |
CVE-2020-11076 | High | 7.5 | 2020-05-22 | In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed… |
CVE-2020-7655 | Medium | 6.1 | 2020-05-21 | netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transf… |
CVE-2020-11506 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab 10.7.0 and later through 12.9.2. A Workhorse bypass could lead to job artifact uploads and file disclosure (Exposure of Sensi… |
CVE-2020-11505 | High | 7.5 | 2020-04-22 | An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 12.7.9, 12.8.x before 12.8.9, and 12.9.x before 12.9.3. A Workhorse… |
CVE-2020-11724 | High | 7.5 | 2020-04-12 | An issue was discovered in OpenResty before 1.15.8.4. ngx_http_lua_subrequest.c allows HTTP request smuggling, as demonstrated by the ngx.location.capture API. |
CVE-2020-7611 | Critical | 9.8 | 2020-03-30 | All versions of io.micronaut:micronaut-http-client before 1.2.11 and all versions from 1.3.0 before 1.3.2 are vulnerable to HTTP Request Header Injection due t… |
CVE-2020-5129 | High | 7.5 | 2020-03-26 | A vulnerability in the SonicWall SMA1000 HTTP Extraweb server allows an unauthenticated remote attacker to cause HTTP server crash which leads to Denial of Ser… |
CVE-2020-1944 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content… |
CVE-2019-17565 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to v… |
CVE-2019-17559 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to ver… |
CVE-2020-10109 | Critical | 9.8 | 2020-03-12 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the cont… |
CVE-2020-10108 | Critical | 9.8 | 2020-03-12 | In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header… |
CVE-2020-10112 | Medium | 5.4 | 2020-03-06 | Citrix Gateway 11.1, 12.0, and 12.1 allows Cache Poisoning. NOTE: Citrix disputes this as not a vulnerability. By default, Citrix ADC only caches static conten… |
CVE-2020-10111 | High | 7.5 | 2020-03-06 | Citrix Gateway 11.1, 12.0, and 12.1 has an Inconsistent Interpretation of HTTP Requests. NOTE: Citrix disputes the reported behavior as not a security issue. C… |
CVE-2019-19223 | High | 7.5 | 2020-03-04 | A Broken Access Control vulnerability in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an attacker to reboot the router by submitt… |
CVE-2020-5401 | Medium | 5.3 | 2020-02-27 | Cloud Foundry Routing Release, versions prior to 0.197.0, contains GoRouter, which allows malicious clients to send invalid headers, causing caching layers to… |
CVE-2020-1935 | Medium | 4.8 | 2020-02-24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some… |
CVE-2019-17569 | Medium | 4.8 | 2020-02-24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that… |
CVE-2015-5741 | Critical | 9.8 | 2020-02-08 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smu… |
CVE-2019-15605 | Critical | 9.8 | 2020-02-07 | HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed |
CVE-2019-20445 | Critical | 9.1 | 2020-01-29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding hea… |
CVE-2019-20444 | Critical | 9.1 | 2020-01-29 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect synta… |
CVE-2020-5220 | Medium | 4.4 | 2020-01-27 | Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended seriali… |
CVE-2020-5218 | Medium | 4.4 | 2020-01-27 | Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be… |
CVE-2020-5207 | Medium | 5.4 | 2020-01-27 | In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't ha… |
CVE-2020-7238 | High | 7.5 | 2020-01-27 | Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a lat… |
CVE-2019-16792 | High | 7.1 | 2020-01-22 | Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header a… |
CVE-2019-20372 | Medium | 5.3 | 2020-01-09 | NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized… |
CVE-2019-16789 | High | 7.1 | 2019-12-26 | In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end an… |
CVE-2019-16786 | High | 7.1 | 2019-12-20 | Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall th… |
CVE-2019-16785 | High | 7.1 | 2019-12-20 | Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the… |
CVE-2019-18678 | Medium | 5.3 | 2019-11-26 | An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that split… |
CVE-2019-18277 | High | 7.5 | 2019-10-23 | A flaw was found in HAProxy before 2.0.6. In legacy mode, messages featuring a transfer-encoding header missing the "chunked" value were not being correctly re… |
CVE-2019-15272 | Medium | 6.5 | 2019-10-02 | A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition (SME) co… |
CVE-2019-16276 | High | 7.5 | 2019-09-30 | Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP Request Smuggling. |
CVE-2019-16869 | High | 7.5 | 2019-09-26 | Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request sm… |
CVE-2019-1020012 | High | 7.5 | 2019-07-29 | parse-server before 3.4.1 allows DoS after any POST to a volatile class. |
CVE-2019-0197 | Medium | 4.2 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an… |
CVE-2018-4030 | High | 7.5 | 2019-03-21 | An exploitable vulnerability exists the safe browsing function of the CUJO Smart Firewall, version 7003. The bug lies in the way the safe browsing function par… |
CVE-2018-8004 | Medium | 6.5 | 2018-08-29 | There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS). This affects ver… |
CVE-2018-3908 | High | 7.5 | 2018-08-28 | An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250-Firmware version 0.20.17. The vid… |
CVE-2018-3909 | High | 8.6 | 2018-08-24 | An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The v… |
CVE-2018-3907 | Critical | 10.0 | 2018-08-24 | An exploitable vulnerability exists in the REST parser of video-core's HTTP server of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The v… |
CVE-2018-7068 | Medium | 6.1 | 2018-08-06 | HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF… |
CVE-2017-12165 | Low | 2.6 | 2018-07-27 | It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request s… |
CVE-2017-2666 | Medium | 6.5 | 2018-07-27 | It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a prox… |
CVE-2017-7658 | Critical | 9.8 | 2018-06-26 | In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two co… |
CVE-2017-7657 | Critical | 9.8 | 2018-06-26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encodin… |
CVE-2017-7656 | High | 7.5 | 2018-06-26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is hand… |
CVE-2016-10711 | Critical | 9.8 | 2018-01-29 | Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. |
CVE-2017-7559 | Medium | 6.1 | 2018-01-10 | In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and i… |
CVE-2017-12158 | Medium | 5.4 | 2017-10-26 | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw… |
CVE-2017-15643 | High | 7.4 | 2017-10-19 | An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP… |
CVE-2015-5740 | Critical | 9.8 | 2017-10-18 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smu… |
CVE-2015-5739 | Critical | 9.8 | 2017-10-18 | The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP requ… |
CVE-2017-7561 | High | 7.5 | 2017-09-13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in… |
CVE-2017-8894 | High | 8.1 | 2017-07-02 | AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code in… |
CVE-2006-6276 | | 2006-12-04 | HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web… | |
CVE-2005-2089 | | 2005-07-05 | Microsoft IIS 5.0 and 6.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP requ… | |
CVE-2005-2088 | | 2005-07-05 | The Apache HTTP server before 1.3.34, and 2.0.x before 2.0.55, when acting as an HTTP proxy, allows remote attackers to poison the web cache, bypass web applic… |