Common Weakness Enumeration
CWE-444
AllowedInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Abstraction: Base · Status: Incomplete
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
312 vulnerabilities reference this CWE, most recent first.
CVE-2026-86146 (GCVE-0-2026-86146)
Vulnerability from cvelistv5 – Published: 2026-10-21 12:15 – Updated: 2026-10-30 14:40
VLAI
EPSS
VEX
Title
Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing
Summary
Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.
Root Cause:
The bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:
1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC's framing while the reported field name contains the trailing space.
2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).
3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC's framing while a front-end that does not unfold sees a different message.
4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.
5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.
Affected Scenarios:
bRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.
How to Fix:
(Choose one of the following options)
1. Upgrade bRPC to version 1.18.0, which fixes this issue.
2. Apply this patch: https://github.com/apache/brpc/pull/3521
Note:
After applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-30 14:40 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
apache
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/2pf15ojj0vr7rtx95… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache bRPC |
Affected:
0 , < 1.18.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-86146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-30T14:40:46.501949Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T14:40:59.777Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://github.com",
"defaultStatus": "unaffected",
"packageName": "apache/brpc",
"packageURL": "pkg:github/apache/brpc",
"product": "Apache bRPC",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.18.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Claude"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u0026lt; 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\u003cbr\u003e\u003cbr\u003eRoot Cause:\u003cbr\u003eThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\u003cbr\u003e1. A space before the colon of framing headers (e.g. \u003ccode\u003eContent-Length : 5\u003c/code\u003e) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\u003cbr\u003e2. Interior spaces inside a \u003ccode\u003eContent-Length\u003c/code\u003e value (e.g. \u003ccode\u003eContent-Length: 1 3\u003c/code\u003e) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\u003cbr\u003e3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of \u003ccode\u003eContent-Length\u003c/code\u003e and \u003ccode\u003eTransfer-Encoding\u003c/code\u003e values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\u003cbr\u003e4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as \u003ccode\u003eAuthorization\u003c/code\u003e or \u003ccode\u003eX-Forwarded-For\u003c/code\u003e past it.\u003cbr\u003e5. \u003ccode\u003eTransfer-Encoding\u003c/code\u003e lists with optional whitespace after a comma (e.g. \u003ccode\u003eTransfer-Encoding: gzip, chunked\u003c/code\u003e) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\u003cbr\u003e\u003cbr\u003eAffected Scenarios:\u003cbr\u003ebRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. \u003ccode\u003eAuthorization\u003c/code\u003e, \u003ccode\u003eX-Forwarded-For\u003c/code\u003e) via chunked trailers, or desynchronize responses.\u003cbr\u003e\u003cbr\u003eHow to Fix:\u003cbr\u003e(Choose one of the following options)\u003cbr\u003e1. Upgrade bRPC to version 1.18.0, which fixes this issue.\u003cbr\u003e2. Apply this patch: \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/apache/brpc/pull/3521\"\u003ehttps://github.com/apache/brpc/pull/3521\u003c/a\u003e\u003cbr\u003e\u003cbr\u003eNote:\u003cbr\u003eAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: \u003ccode\u003ehttp_allow_obs_fold=true\u003c/code\u003e restores acceptance of folded \u003ccode\u003eContent-Length\u003c/code\u003e/\u003ccode\u003eTransfer-Encoding\u003c/code\u003e values, and \u003ccode\u003ehttp_strict_header_token=true\u003c/code\u003e additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
}
],
"value": "Inconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version \u003c 1.18.0) on all platforms allows remote attackers to smuggle requests and inject headers when bRPC is deployed behind a proxy or load balancer that parses the same bytes differently.\n\nRoot Cause:\nThe bRPC fork of http-parser accepts and acts on several HTTP/1.1 header forms that a conforming front-end either rejects or interprets differently, so the framing or the header set of a message can differ between the front-end and bRPC:\n1. A space before the colon of framing headers (e.g. Content-Length : 5) is accepted; the value still drives bRPC\u0027s framing while the reported field name contains the trailing space.\n2. Interior spaces inside a Content-Length value (e.g. Content-Length: 1 3) are skipped, so bRPC reads 13 where a front-end reads 1 or rejects the message (same class as CVE-2022-32213 in Node.js).\n3. Obsolete line folding (obs-fold, RFC 7230 3.2.4) of Content-Length and Transfer-Encoding values is accepted, so a folded framing value drives bRPC\u0027s framing while a front-end that does not unfold sees a different message.\n4. Chunked trailer fields are fed to the same header callbacks as the header section and are merged into the header map like real headers. A front-end only inspects the header section, so any chunked request can smuggle fields such as Authorization or X-Forwarded-For past it.\n5. Transfer-Encoding lists with optional whitespace after a comma (e.g. Transfer-Encoding: gzip, chunked) are not recognized as chunked: such requests are rejected, and responses are read until connection close instead of as chunked, causing response desync.\n\nAffected Scenarios:\nbRPC server or client communicating over HTTP/1.1 with a front proxy, load balancer, or any peer that parses the message independently. An attacker able to send requests through the front-end can desynchronize the two parsers to smuggle requests, forge headers (e.g. Authorization, X-Forwarded-For) via chunked trailers, or desynchronize responses.\n\nHow to Fix:\n(Choose one of the following options)\n1. Upgrade bRPC to version 1.18.0, which fixes this issue.\n2. Apply this patch: https://github.com/apache/brpc/pull/3521 \n\nNote:\nAfter applying the fix, the four header forms above are rejected by default and chunked trailers are dropped instead of merged into the header map. Two gflags are provided for compatibility: http_allow_obs_fold=true restores acceptance of folded Content-Length/Transfer-Encoding values, and http_strict_header_token=true additionally rejects spaces inside any header field name (not only the ones that decide framing). Legitimate clients that do not use these obsolete forms are unaffected."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T12:15:26.421Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/2pf15ojj0vr7rtx95677kgtl1mx3gdgb"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache bRPC: HTTP Request Smuggling and Header Injection via Lenient HTTP/1.1 Header Parsing",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-86146",
"datePublished": "2026-10-21T12:15:26.421Z",
"dateReserved": "2026-09-05T07:10:31.972Z",
"dateUpdated": "2026-10-30T14:40:59.777Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-85078 (GCVE-0-2026-85078)
Vulnerability from cvelistv5 – Published: 2026-09-17 14:28 – Updated: 2026-09-17 19:19
VLAI
EPSS
VEX
Title
sanic chunked trailer request smuggling allows hidden second request execution
Summary
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:06 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/sanic-org/sanic/security/advis… | x_refsource_CONFIRM |
| https://github.com/sanic-org/sanic/pull/3164 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/pull/3165 | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/47349d6… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/69a10d3… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/commit/a332796… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
| https://github.com/sanic-org/sanic/releases/tag/v… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85078",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:06:16.358452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T19:19:53.849Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "sanic",
"vendor": "sanic-org",
"versions": [
{
"status": "affected",
"version": "\u003c 24.12.1"
},
{
"status": "affected",
"version": "\u003e= 25.12.0, \u003c 25.12.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Sanic is an opensource python web server/framework. In version 25.12.0, Sanic\u0027s core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T14:28:37.286Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/sanic-org/sanic/security/advisories/GHSA-wmj6-g64g-j7q5"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3164",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3164"
},
{
"name": "https://github.com/sanic-org/sanic/pull/3165",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/pull/3165"
},
{
"name": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/47349d689d65fa1907977ac100e867894aeafb22"
},
{
"name": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/69a10d3b06babaa9e5f6d1af577364e9e53b6dea"
},
{
"name": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/commit/a332796506c7c588b6930b02a8886e43eb8ea8d6"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v24.12.1"
},
{
"name": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/sanic-org/sanic/releases/tag/v25.12.1"
}
],
"source": {
"advisory": "GHSA-wmj6-g64g-j7q5",
"discovery": "UNKNOWN"
},
"title": "sanic chunked trailer request smuggling allows hidden second request execution"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-85078",
"datePublished": "2026-09-17T14:28:37.286Z",
"dateReserved": "2026-09-02T21:21:01.776Z",
"dateUpdated": "2026-09-17T19:19:53.849Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84380 (GCVE-0-2026-84380)
Vulnerability from cvelistv5 – Published: 2026-09-02 17:58 – Updated: 2026-09-02 18:07
VLAI
EPSS
VEX
Title
HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated
Summary
HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0.
Severity
5.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 18:07 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/pydantic/httpx2/security/advis… | x_refsource_CONFIRM |
| https://github.com/pydantic/httpx2/pull/1137 | x_refsource_MISC |
| https://github.com/pydantic/httpx2/commit/829b93a… | x_refsource_MISC |
| https://github.com/pydantic/httpx2/releases/tag/v2.11.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T18:07:09.850518Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T18:07:36.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "httpx2",
"vendor": "pydantic",
"versions": [
{
"status": "affected",
"version": "\u003c 2.11.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:58:55.520Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/pydantic/httpx2/security/advisories/GHSA-pf96-p4fj-6566",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/pydantic/httpx2/security/advisories/GHSA-pf96-p4fj-6566"
},
{
"name": "https://github.com/pydantic/httpx2/pull/1137",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/httpx2/pull/1137"
},
{
"name": "https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/httpx2/commit/829b93a2393212996f613e635261f777d9ec6eab"
},
{
"name": "https://github.com/pydantic/httpx2/releases/tag/v2.11.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/pydantic/httpx2/releases/tag/v2.11.0"
}
],
"source": {
"advisory": "GHSA-pf96-p4fj-6566",
"discovery": "UNKNOWN"
},
"title": "HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84380",
"datePublished": "2026-09-02T17:58:55.520Z",
"dateReserved": "2026-09-01T16:27:58.130Z",
"dateUpdated": "2026-09-02T18:07:36.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-84363 (GCVE-0-2026-84363)
Vulnerability from cvelistv5 – Published: 2026-09-01 20:22 – Updated: 2026-09-02 12:19
VLAI
EPSS
VEX
Title
Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
Summary
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 12:19 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/honojs/hono/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/honojs/hono/commit/9c28d724c5a… | x_refsource_MISC |
| https://github.com/honojs/hono/releases/tag/v4.13.5 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-84363",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T12:19:17.820986Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T12:19:50.946Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "hono",
"vendor": "honojs",
"versions": [
{
"status": "affected",
"version": "\u003c 4.13.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono\u0027s query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T20:22:59.164Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/honojs/hono/security/advisories/GHSA-crvj-82cr-hjcx"
},
{
"name": "https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/commit/9c28d724c5a7fb086ebaa812fdc1ad6e957c63bc"
},
{
"name": "https://github.com/honojs/hono/releases/tag/v4.13.5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/honojs/hono/releases/tag/v4.13.5"
}
],
"source": {
"advisory": "GHSA-crvj-82cr-hjcx",
"discovery": "UNKNOWN"
},
"title": "Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-84363",
"datePublished": "2026-09-01T20:22:59.164Z",
"dateReserved": "2026-09-01T16:27:58.128Z",
"dateUpdated": "2026-09-02T12:19:50.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82672 (GCVE-0-2026-82672)
Vulnerability from cvelistv5 – Published: 2026-09-19 17:00 – Updated: 2026-09-21 18:30
VLAI
EPSS
VEX
Title
Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections
Summary
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.
Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends.
This issue affects mint: from 0.1.0 before 1.10.1.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:29 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
EEF
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/elixir-mint/mint/security/advi… | relatedvendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-82672.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-82672 | related |
| https://github.com/elixir-mint/mint/commit/600895… | related |
| https://github.com/elixir-mint/mint/commit/c82377… | patch |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| elixir-mint | mint |
Affected:
0.1.0 , < 1.10.1
(semver)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
|
| elixir-mint | mint |
Affected:
60089586ec7adc9fddb09f69a2f5919ba9ac7f33 , < c82377838dc6e275ef40bafa664fbcdf50270c60
(git)
cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82672",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:29:40.588404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:30:02.604Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-rj5m-69wp-cxq9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1.Parse\u0027",
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "mint",
"packageURL": "pkg:hex/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1/parse.ex",
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1.Parse\u0027:chunk_size/1"
},
{
"name": "\u0027Elixir.Mint.HTTP1.Parse\u0027:ignore_until_crlf/1"
},
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_body/5"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "1.10.1",
"status": "affected",
"version": "0.1.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.Mint.HTTP1.Parse\u0027",
"\u0027Elixir.Mint.HTTP1\u0027"
],
"packageName": "elixir-mint/mint",
"packageURL": "pkg:github/elixir-mint/mint",
"product": "mint",
"programFiles": [
"lib/mint/http1/parse.ex",
"lib/mint/http1.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.Mint.HTTP1.Parse\u0027:chunk_size/1"
},
{
"name": "\u0027Elixir.Mint.HTTP1.Parse\u0027:ignore_until_crlf/1"
},
{
"name": "\u0027Elixir.Mint.HTTP1\u0027:decode_body/5"
}
],
"repo": "https://github.com/elixir-mint/mint",
"vendor": "elixir-mint",
"versions": [
{
"lessThan": "c82377838dc6e275ef40bafa664fbcdf50270c60",
"status": "affected",
"version": "60089586ec7adc9fddb09f69a2f5919ba9ac7f33",
"versionType": "git"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExploitation requires a deployment topology in which an RFC-strict HTTP/1 intermediary (proxy, load balancer, or WAF) sits between the Mint client and the attacker-influenced origin, and HTTP/1 connections between the client and the intermediary are reused across requests (keep-alive with connection pooling). Mint clients that talk directly to an origin without an intermediary, or that do not reuse connections, are not exploitable for response-queue poisoning even if the vulnerable parsing behavior is present.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Exploitation requires a deployment topology in which an RFC-strict HTTP/1 intermediary (proxy, load balancer, or WAF) sits between the Mint client and the attacker-influenced origin, and HTTP/1 connections between the client and the intermediary are reused across requests (keep-alive with connection pooling). Mint clients that talk directly to an origin without an intermediary, or that do not reuse connections, are not exploitable for response-queue poisoning even if the vulnerable parsing behavior is present."
}
],
"value": "Exploitation requires a deployment topology in which an RFC-strict HTTP/1 intermediary (proxy, load balancer, or WAF) sits between the Mint client and the attacker-influenced origin, and HTTP/1 connections between the client and the intermediary are reused across requests (keep-alive with connection pooling). Mint clients that talk directly to an origin without an intermediary, or that do not reuse connections, are not exploitable for response-queue poisoning even if the vulnerable parsing behavior is present."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:elixir-mint:mint:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.10.1",
"versionStartIncluding": "0.1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "reporter",
"value": "Eurico Nicacio"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Eric Meadows-J\u00f6nsson"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "Andrea Leopardi"
}
],
"dateAssigned": "2026-09-19T15:55:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eMint.HTTP1.Parse.chunk_size/1\u003c/code\u003e in \u003ccode\u003elib/mint/http1/parse.ex\u003c/code\u003e stops at the first non-hexadecimal byte of a chunked response\u0027s chunk-size line and returns the remainder unexamined. \u003ccode\u003eMint.HTTP1.decode_body/5\u003c/code\u003e in \u003ccode\u003elib/mint/http1.ex\u003c/code\u003e then discards every byte up to the CRLF with \u003ccode\u003eParse.ignore_until_crlf/1\u003c/code\u003e, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a \u003ccode\u003e;\u003c/code\u003e-introduced chunk extension. Lines such as \u003ccode\u003e5ZZZZZ\u003c/code\u003e and \u003ccode\u003e5 9\u003c/code\u003e are accepted as chunk size 5, and \u003ccode\u003e0ZZZZ\u003c/code\u003e is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends.\u003c/p\u003e\n\u003cp\u003eThis issue affects mint: from 0.1.0 before 1.10.1.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.\n\n`Mint.HTTP1.Parse.chunk_size/1` in `lib/mint/http1/parse.ex` stops at the first non-hexadecimal byte of a chunked response\u0027s chunk-size line and returns the remainder unexamined. `Mint.HTTP1.decode_body/5` in `lib/mint/http1.ex` then discards every byte up to the CRLF with `Parse.ignore_until_crlf/1`, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a `;`-introduced chunk extension. Lines such as `5ZZZZZ` and `5 9` are accepted as chunk size 5, and `0ZZZZ` is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends.\n\nThis issue affects mint: from 0.1.0 before 1.10.1."
}
],
"value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection.\n\nMint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response\u0027s chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends.\n\nThis issue affects mint: from 0.1.0 before 1.10.1."
}
],
"impacts": [
{
"capecId": "CAPEC-273",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA malicious or attacker-influenced HTTP/1 origin behind an RFC-strict intermediary can make the intermediary and the Mint client disagree on chunk boundaries and on where the response body ends. On a pooled keep-alive connection that disagreement lets bytes from one response be attributed to the next, poisoning the responses returned to unrelated requests that share the connection.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "A malicious or attacker-influenced HTTP/1 origin behind an RFC-strict intermediary can make the intermediary and the Mint client disagree on chunk boundaries and on where the response body ends. On a pooled keep-alive connection that disagreement lets bytes from one response be attributed to the next, poisoning the responses returned to unrelated requests that share the connection."
}
],
"value": "A malicious or attacker-influenced HTTP/1 origin behind an RFC-strict intermediary can make the intermediary and the Mint client disagree on chunk boundaries and on where the response body ends. On a pooled keep-alive connection that disagreement lets bytes from one response be attributed to the next, poisoning the responses returned to unrelated requests that share the connection."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-19T17:00:31.648Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "GitHub Advisory",
"tags": [
"related",
"vendor-advisory"
],
"url": "https://github.com/elixir-mint/mint/security/advisories/GHSA-rj5m-69wp-cxq9"
},
{
"name": "EEF CNA record for CVE-2026-82672",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-82672.html"
},
{
"name": "OSV record EEF-CVE-2026-82672",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-82672"
},
{
"name": "Introducing commit 6008958 in elixir-mint/mint",
"tags": [
"related"
],
"url": "https://github.com/elixir-mint/mint/commit/60089586ec7adc9fddb09f69a2f5919ba9ac7f33"
},
{
"name": "Fix commit c823778 in elixir-mint/mint",
"tags": [
"patch"
],
"url": "https://github.com/elixir-mint/mint/commit/c82377838dc6e275ef40bafa664fbcdf50270c60"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections",
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a loopback TCP server that serves one \u003ccode\u003eHTTP/1.1 200 OK\u003c/code\u003e response with \u003ccode\u003etransfer-encoding: chunked\u003c/code\u003e and controls the chunk-size line byte for byte.\u003c/li\u003e\n\u003cli\u003eConnect with \u003ccode\u003eMint.HTTP1\u003c/code\u003e (mint 1.10.0 from Hex), send a request and stream the response.\u003c/li\u003e\n\u003cli\u003ePositive controls: chunk-size lines \u003ccode\u003e+5\u003c/code\u003e, \u003ccode\u003eZ5\u003c/code\u003e and \u003ccode\u003e00000000000000005\u003c/code\u003e are refused with \u003ccode\u003e:invalid_chunk_size\u003c/code\u003e, confirming the build carries the earlier chunk-size fixes.\u003c/li\u003e\n\u003cli\u003eBaseline: \u003ccode\u003e5\u003c/code\u003e and \u003ccode\u003e5;name=value\u003c/code\u003e are accepted with body \u003ccode\u003ehello\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFinding: \u003ccode\u003e5ZZZZZ\u003c/code\u003e, \u003ccode\u003e5 anything at all\u003c/code\u003e, \u003ccode\u003e5\u0026lt;TAB\u0026gt;foo\u003c/code\u003e, \u003ccode\u003e5 9\u003c/code\u003e and \u003ccode\u003e5}~!\u003c/code\u003e are each accepted as chunk size 5 with body \u003ccode\u003ehello\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eTerminator: \u003ccode\u003e0ZZZZ\u003c/code\u003e and \u003ccode\u003e0 9\u003c/code\u003e in place of the final \u003ccode\u003e0\u003c/code\u003e chunk are accepted and end the body.\u003c/li\u003e\n\u003cli\u003eContrast: \u003ccode\u003eContent-Length: +5\u003c/code\u003e, \u003ccode\u003eContent-Length: 5ZZZ\u003c/code\u003e and \u003ccode\u003eContent-Length: 5 9\u003c/code\u003e are refused with \u003ccode\u003e:invalid_content_length_header\u003c/code\u003e in the same run.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eThe reporter ran this on Elixir 1.18 / OTP 27 and Elixir 1.18.4 / OTP 28 with identical results.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a loopback TCP server that serves one `HTTP/1.1 200 OK` response with `transfer-encoding: chunked` and controls the chunk-size line byte for byte.\n2. Connect with `Mint.HTTP1` (mint 1.10.0 from Hex), send a request and stream the response.\n3. Positive controls: chunk-size lines `+5`, `Z5` and `00000000000000005` are refused with `:invalid_chunk_size`, confirming the build carries the earlier chunk-size fixes.\n4. Baseline: `5` and `5;name=value` are accepted with body `hello`.\n5. Finding: `5ZZZZZ`, `5 anything at all`, `5\u003cTAB\u003efoo`, `5 9` and `5}~!` are each accepted as chunk size 5 with body `hello`.\n6. Terminator: `0ZZZZ` and `0 9` in place of the final `0` chunk are accepted and end the body.\n7. Contrast: `Content-Length: +5`, `Content-Length: 5ZZZ` and `Content-Length: 5 9` are refused with `:invalid_content_length_header` in the same run.\n\nThe reporter ran this on Elixir 1.18 / OTP 27 and Elixir 1.18.4 / OTP 28 with identical results."
}
],
"value": "* Start a loopback TCP server that serves one HTTP/1.1 200 OK response with transfer-encoding: chunked and controls the chunk-size line byte for byte.\n* Connect with Mint.HTTP1 (mint 1.10.0 from Hex), send a request and stream the response.\n* Positive controls: chunk-size lines +5, Z5 and 00000000000000005 are refused with :invalid_chunk_size, confirming the build carries the earlier chunk-size fixes.\n* Baseline: 5 and 5;name=value are accepted with body hello.\n* Finding: 5ZZZZZ, 5 anything at all, 5\u003cTAB\u003efoo, 5 9 and 5}~! are each accepted as chunk size 5 with body hello.\n* Terminator: 0ZZZZ and 0 9 in place of the final 0 chunk are accepted and end the body.\n* Contrast: Content-Length: +5, Content-Length: 5ZZZ and Content-Length: 5 9 are refused with :invalid_content_length_header in the same run.\n\nThe reporter ran this on Elixir 1.18 / OTP 27 and Elixir 1.18.4 / OTP 28 with identical results."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Chunk-size parsing.\u003c/strong\u003e \u003ccode\u003eMint.HTTP1.Parse.chunk_size/1\u003c/code\u003e in \u003ccode\u003elib/mint/http1/parse.ex\u003c/code\u003e folds leading hexadecimal digits into an accumulator through \u003ccode\u003eparse_hex_prefix/3\u003c/code\u003e and, on the first byte that is not a hex digit, returns \u003ccode\u003e{:ok, size, rest}\u003c/code\u003e with \u003ccode\u003erest\u003c/code\u003e unexamined. The sign and digit-count checks added by earlier fixes constrain only the digits.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Tail skipping.\u003c/strong\u003e The caller, \u003ccode\u003eMint.HTTP1.decode_body/5\u003c/code\u003e in \u003ccode\u003elib/mint/http1.ex\u003c/code\u003e, hands \u003ccode\u003erest\u003c/code\u003e to \u003ccode\u003eParse.ignore_until_crlf/1\u003c/code\u003e, which advances over any byte until it finds CRLF. Nothing between the last hex digit and the CRLF is validated, so the accepted grammar is \u003ccode\u003e1*HEXDIG *OCTET CRLF\u003c/code\u003e, where RFC 9112 section 7.1 allows only an optional \u003ccode\u003e;\u003c/code\u003e-introduced \u003ccode\u003echunk-ext\u003c/code\u003e. The same tolerance applies to the terminating zero-length chunk, which is the token that ends the message body.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Parser disagreement.\u003c/strong\u003e The sibling \u003ccode\u003eContent-Length\u003c/code\u003e parser, \u003ccode\u003eMint.HTTP1.Parse.content_length_header/1\u003c/code\u003e, trims trailing whitespace and requires the whole remaining value to be digits, rejecting anything else. An RFC-strict intermediary that rejects or reframes a chunk-size line with a non-extension tail, on a connection where Mint accepts it, yields a framing disagreement about chunk length and, through the terminating chunk, about where the message ends.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Chunk-size parsing.** `Mint.HTTP1.Parse.chunk_size/1` in `lib/mint/http1/parse.ex` folds leading hexadecimal digits into an accumulator through `parse_hex_prefix/3` and, on the first byte that is not a hex digit, returns `{:ok, size, rest}` with `rest` unexamined. The sign and digit-count checks added by earlier fixes constrain only the digits.\n\n**2. Tail skipping.** The caller, `Mint.HTTP1.decode_body/5` in `lib/mint/http1.ex`, hands `rest` to `Parse.ignore_until_crlf/1`, which advances over any byte until it finds CRLF. Nothing between the last hex digit and the CRLF is validated, so the accepted grammar is `1*HEXDIG *OCTET CRLF`, where RFC 9112 section 7.1 allows only an optional `;`-introduced `chunk-ext`. The same tolerance applies to the terminating zero-length chunk, which is the token that ends the message body.\n\n**3. Parser disagreement.** The sibling `Content-Length` parser, `Mint.HTTP1.Parse.content_length_header/1`, trims trailing whitespace and requires the whole remaining value to be digits, rejecting anything else. An RFC-strict intermediary that rejects or reframes a chunk-size line with a non-extension tail, on a connection where Mint accepts it, yields a framing disagreement about chunk length and, through the terminating chunk, about where the message ends."
}
],
"value": "1. Chunk-size parsing. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex folds leading hexadecimal digits into an accumulator through parse_hex_prefix/3 and, on the first byte that is not a hex digit, returns {:ok, size, rest} with rest unexamined. The sign and digit-count checks added by earlier fixes constrain only the digits.\n\n2. Tail skipping. The caller, Mint.HTTP1.decode_body/5 in lib/mint/http1.ex, hands rest to Parse.ignore_until_crlf/1, which advances over any byte until it finds CRLF. Nothing between the last hex digit and the CRLF is validated, so the accepted grammar is 1*HEXDIG *OCTET CRLF, where RFC 9112 section 7.1 allows only an optional ;-introduced chunk-ext. The same tolerance applies to the terminating zero-length chunk, which is the token that ends the message body.\n\n3. Parser disagreement. The sibling Content-Length parser, Mint.HTTP1.Parse.content_length_header/1, trims trailing whitespace and requires the whole remaining value to be digits, rejecting anything else. An RFC-strict intermediary that rejects or reframes a chunk-size line with a non-extension tail, on a connection where Mint accepts it, yields a framing disagreement about chunk length and, through the terminating chunk, about where the message ends."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-82672",
"datePublished": "2026-09-19T17:00:31.648Z",
"dateReserved": "2026-09-17T05:30:01.748Z",
"dateUpdated": "2026-09-21T18:30:02.604Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-81356 (GCVE-0-2026-81356)
Vulnerability from cvelistv5 – Published: 2026-09-08 17:13 – Updated: 2026-10-31 16:12
VLAI
EPSS
VEX
Title
Visual Studio Code Security Feature Bypass Vulnerability
Summary
Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 14:30 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
microsoft
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Visual Studio Code |
Affected:
1.0.0 , < 1.136.2
(custom)
cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:* |
Date Public
2026-09-08 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-81356",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T14:30:30.828393Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T14:30:59.252Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Visual Studio Code",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "1.136.2",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:visual_studio_code:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.136.2",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-09-08T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Inconsistent interpretation of http requests (\u0027http request/response smuggling\u0027) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T16:12:43.736Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Visual Studio Code Security Feature Bypass Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81356"
}
],
"title": "Visual Studio Code Security Feature Bypass Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-81356",
"datePublished": "2026-09-08T17:13:56.435Z",
"dateReserved": "2026-08-26T18:40:19.856Z",
"dateUpdated": "2026-10-31T16:12:43.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78605 (GCVE-0-2026-78605)
Vulnerability from cvelistv5 – Published: 2026-09-01 19:20 – Updated: 2026-09-01 19:41
VLAI
EPSS
VEX
Title
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information Disclosure
Summary
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 19:41 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
Assigner
elastic
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Elastic | Elasticsearch |
Affected:
8.18.0 , ≤ 8.19.19
(semver)
Affected: 9.0.0 , ≤ 9.4.4 (semver) Affected: 9.5.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78605",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T19:41:44.021783Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T19:41:50.325Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Elasticsearch",
"vendor": "Elastic",
"versions": [
{
"lessThanOrEqual": "8.19.19",
"status": "affected",
"version": "8.18.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.4.4",
"status": "affected",
"version": "9.0.0",
"versionType": "semver"
},
{
"status": "affected",
"version": "9.5.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027) (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.\u003c/p\u003e"
}
],
"value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027) (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T19:20:29.342Z",
"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"shortName": "elastic"
},
"references": [
{
"url": "https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-141/390092"
}
],
"source": {
"discovery": "Elastic"
},
"title": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request Smuggling\u0027) in Elasticsearch Leading to Information Disclosure",
"x_generator": {
"engine": "Elastic CVE Publisher 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a",
"assignerShortName": "elastic",
"cveId": "CVE-2026-78605",
"datePublished": "2026-09-01T19:20:29.342Z",
"dateReserved": "2026-08-24T21:13:52.890Z",
"dateUpdated": "2026-09-01T19:41:50.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77803 (GCVE-0-2026-77803)
Vulnerability from cvelistv5 – Published: 2026-10-05 12:39 – Updated: 2026-10-06 17:50
VLAI
EPSS
VEX
Title
Front-end Desynchronization Vulnerability in Progress® Telerik® Fiddler® Classic
Summary
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:50 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
ProgressSoftware
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://docs.telerik.com/fiddler/knowledge-base/k… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | Progress® Telerik® Fiddler® Classic |
Affected:
1.0.0 , < 6.0.20262.10021
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:50:20.748709Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:50:34.935Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "6.0.20262.10021",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NATO Cyber Security Centre (NCSC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server."
}
],
"value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy request forwarding component. A request that contains both a Content-Length and a Transfer-Encoding header is forwarded with both headers present, while Fiddler frames the body using Transfer-Encoding only. The remaining bytes on the reused client connection are then parsed as a separate pipelined request, so a local threat actor with low privileges can cause a single malformed request to be split into two requests forwarded to the origin server and receive an additional smuggled response, without requiring a vulnerable server."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T12:39:36.806Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.telerik.com/fiddler/knowledge-base/kb-security-front-end-desynchronization-cve-2026-77803"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Front-end Desynchronization Vulnerability in Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eDisable client connection reuse in Fiddler Classic: open \u003cb\u003eTools \u0026gt; Options \u0026gt; Connections\u003c/b\u003e and uncheck the \u003cb\u003e\"Reuse client connections\"\u003c/b\u003e checkbox. Disabling client pipe reuse prevents the excess data of a malformed request from being parsed as a pipelined request.\u003c/div\u003e"
}
],
"value": "Disable client connection reuse in Fiddler Classic: open Tools \u003e Options \u003e Connections and uncheck the \"Reuse client connections\" checkbox. Disabling client pipe reuse prevents the excess data of a malformed request from being parsed as a pipelined request."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-77803",
"datePublished": "2026-10-05T12:39:36.806Z",
"dateReserved": "2026-08-21T13:37:32.974Z",
"dateUpdated": "2026-10-06T17:50:34.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77802 (GCVE-0-2026-77802)
Vulnerability from cvelistv5 – Published: 2026-10-05 12:38 – Updated: 2026-10-06 17:51
VLAI
EPSS
VEX
Title
HTTP Request Smuggling Vulnerability in Progress® Telerik® Fiddler® Classic
Summary
In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while Fiddler frames the request body using only the first Content-Length value. A local threat actor with low privileges who is able to send requests through the same Fiddler proxy instance as another user can exploit this desynchronization against a non-RFC-9110-compliant origin server that keeps the connection alive to smuggle an additional request. Because Fiddler returns the server connection to its pipe pool after reading only the first response, the unread smuggled response remains buffered on the socket and is served to the next session that reuses that connection, allowing the attacker to poison responses delivered to other users and to obtain responses intended for them.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:50 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
ProgressSoftware
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://docs.telerik.com/fiddler/knowledge-base/k… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progress Software | Progress® Telerik® Fiddler® Classic |
Affected:
1.0.0 , < 6.0.20262.10021
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:50:58.548832Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:51:15.128Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic",
"vendor": "Progress Software",
"versions": [
{
"lessThan": "6.0.20262.10021",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NATO Cyber Security Centre (NCSC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while Fiddler frames the request body using only the first Content-Length value. A local threat actor with low privileges who is able to send requests through the same Fiddler proxy instance as another user can exploit this desynchronization against a non-RFC-9110-compliant origin server that keeps the connection alive to smuggle an additional request. Because Fiddler returns the server connection to its pipe pool after reading only the first response, the unread smuggled response remains buffered on the socket and is served to the next session that reuses that connection, allowing the attacker to poison responses delivered to other users and to obtain responses intended for them."
}
],
"value": "In Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request forwarding component. Requests containing multiple Content-Length headers with conflicting values are forwarded verbatim to the origin server, while Fiddler frames the request body using only the first Content-Length value. A local threat actor with low privileges who is able to send requests through the same Fiddler proxy instance as another user can exploit this desynchronization against a non-RFC-9110-compliant origin server that keeps the connection alive to smuggle an additional request. Because Fiddler returns the server connection to its pipe pool after reading only the first response, the unread smuggled response remains buffered on the socket and is served to the next session that reuses that connection, allowing the attacker to poison responses delivered to other users and to obtain responses intended for them."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T12:38:58.912Z",
"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"shortName": "ProgressSoftware"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://docs.telerik.com/fiddler/knowledge-base/kb-security-http-request-smuggling-cve-2026-77802"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "HTTP Request Smuggling Vulnerability in Progress\u00ae Telerik\u00ae Fiddler\u00ae Classic",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eDisable server connection reuse in Fiddler Classic: open \u003cb\u003eTools \u0026gt; Options \u0026gt; Connections\u003c/b\u003e and uncheck the \u003cb\u003e\"Reuse server connections\"\u003c/b\u003e checkbox. Disabling server pipe reuse prevents a poisoned server connection from being handed to another session.\u003c/div\u003e"
}
],
"value": "Disable server connection reuse in Fiddler Classic: open Tools \u003e Options \u003e Connections and uncheck the \"Reuse server connections\" checkbox. Disabling server pipe reuse prevents a poisoned server connection from being handed to another session."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05",
"assignerShortName": "ProgressSoftware",
"cveId": "CVE-2026-77802",
"datePublished": "2026-10-05T12:38:58.912Z",
"dateReserved": "2026-08-21T13:37:28.618Z",
"dateUpdated": "2026-10-06T17:51:15.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77756 (GCVE-0-2026-77756)
Vulnerability from cvelistv5 – Published: 2026-09-23 11:18 – Updated: 2026-09-23 18:10
VLAI
EPSS
VEX
Title
Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
Summary
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.
The following versions were EOL at the time the CVE was created but are
known to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.
Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 13:18 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
apache
CNA
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Tomcat |
Affected:
11.0.0-M1 , ≤ 11.0.25
(semver)
Affected: 10.1.0-M1 , ≤ 10.1.59 (semver) Affected: 9.0.47 , ≤ 9.0.121 (semver) Affected: 8.5.67 , ≤ 8.5.100 (semver) Unaffected: 0 , ≤ 7.0.109 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-77756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T13:18:16.430403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T13:18:19.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-09-23T18:10:42.842Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/09/23/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Tomcat",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "11.0.25",
"status": "affected",
"version": "11.0.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "10.1.59",
"status": "affected",
"version": "10.1.0-M1",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.0.121",
"status": "affected",
"version": "9.0.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.5.100",
"status": "affected",
"version": "8.5.67",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.109",
"status": "unaffected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\u003c/p\u003e\u003cp\u003eThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue.\u003c/p\u003e"
}
],
"value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache Tomcat caused by processing the transfer-encoding header for an HTTP/1.0 request may allow an attacker to cause one request from another user to fail when Tomcat is located behind a reverse proxy.\n\n\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.47 through 9.0.121.\n\n\n\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: from 8.5.67 through 8.5.100. Other unsupported versions may also be affected.\n\n\n\nUsers are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T11:18:02.672Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/bl5b6rxqh3vb2k9bj2794vhor7o6xl3z"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-77756",
"datePublished": "2026-09-23T11:18:02.672Z",
"dateReserved": "2026-08-21T09:55:42.227Z",
"dateUpdated": "2026-09-23T18:10:42.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Mitigation
Implementation
Use only SSL communication.
Mitigation
Implementation
Terminate the client session after each request.
Mitigation
System Configuration
Turn all pages to non-cacheable.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.