Common Weakness Enumeration
CWE-444
AllowedInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Abstraction: Base · Status: Incomplete
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
312 vulnerabilities reference this CWE, most recent first.
CVE-2026-75922 (GCVE-0-2026-75922)
Vulnerability from cvelistv5 – Published: 2026-08-23 18:16 – Updated: 2026-08-25 19:30
VLAI
EPSS
VEX
Title
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line
Summary
Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.
PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, '?' or '#' truncates it the same way.
Everything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy's own routing does not expose.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 19:30 UTC
CWE
Assigner
CPANSec
CNA
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-23T21:05:13.636Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/23/2"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-75922",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T19:30:17.806527Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T19:30:38.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://cpan.org/modules",
"defaultStatus": "unaffected",
"modules": [
"Reverse::Proxy"
],
"packageName": "Reverse-Proxy",
"packageURL": "pkg:cpan/Reverse-Proxy",
"programFiles": [
"Proxy.xs"
],
"programRoutines": [
{
"name": "rp_target_url"
},
{
"name": "rp_raw_request"
}
],
"versions": [
{
"lessThan": "0.04",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line.\n\nPSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the client URL has become a raw byte by the time the proxy sees it. The proxy appends that byte string to the upstream base URL, and for an Upgrade tunnel writes it into a request line it serializes itself, re-encoding nothing in either path. The HTTP client that sends the resulting URL does not validate the target either. A path containing %0d%0a therefore arrives at the upstream as a CRLF that ends the request line, and a decoded space, \u0027?\u0027 or \u0027#\u0027 truncates it the same way.\n\nEverything the client writes after the CRLF is read by the upstream as a second request. On the buffered path it arrives on a keep-alive connection the proxy pools and reuses for other clients. Its method, path and headers are all chosen by the client, and the upstream attributes it to the proxy, so it reaches upstream paths that the proxy\u0027s own routing does not expose."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-93",
"description": "CWE-93 Improper Neutralization of CRLF Sequences",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-23T18:16:41.474Z",
"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"shortName": "CPANSec"
},
"references": [
{
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L386-399"
},
{
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.03/source/Proxy.xs#L654-666"
},
{
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/source/Proxy.xs#L400-426"
},
{
"tags": [
"release-notes"
],
"url": "https://metacpan.org/release/LNATION/Reverse-Proxy-0.04/changes"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to Reverse-Proxy 0.04 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line",
"x_generator": {
"engine": "cpansec-cna-tool 0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
"assignerShortName": "CPANSec",
"cveId": "CVE-2026-75922",
"datePublished": "2026-08-23T18:16:41.474Z",
"dateReserved": "2026-08-18T15:10:32.506Z",
"dateUpdated": "2026-08-25T19:30:38.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-74848 (GCVE-0-2026-74848)
Vulnerability from cvelistv5 – Published: 2026-08-27 09:16 – Updated: 2026-08-27 12:05
VLAI
EPSS
VEX
Title
Apache APISIX: Cross-user response poisoning in serverless plugins
Summary
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX.
An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes.
This issue affects Apache APISIX: from 2.12.0 through 3.17.0.
Users are recommended to upgrade to version 3.18.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-27 12:05 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
apache
CNA
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread/xdgpszmw8dw4wvmfx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/0… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache APISIX |
Affected:
2.12.0 , ≤ 3.17.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-08-27T10:22:00.110Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/08/26/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74848",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-27T12:05:10.988716Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T12:05:30.790Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache APISIX",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "3.17.0",
"status": "affected",
"version": "2.12.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Xclow3n (Rajat Raghav)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache APISIX.\u003cbr\u003e\u003cbr\u003eAn attacker could make other clients receive attacker-chosen or other users\u0027 responses on serverless-plugin routes.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Apache APISIX: from 2.12.0 through 3.17.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 3.18.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) vulnerability in Apache APISIX.\n\nAn attacker could make other clients receive attacker-chosen or other users\u0027 responses on serverless-plugin routes.\n\n\n\n\nThis issue affects Apache APISIX: from 2.12.0 through 3.17.0.\n\n\n\nUsers are recommended to upgrade to version 3.18.0, which fixes the issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T09:16:06.985Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/xdgpszmw8dw4wvmfxy043d83m150kx3n"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache APISIX: Cross-user response poisoning in serverless plugins",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-74848",
"datePublished": "2026-08-27T09:16:06.985Z",
"dateReserved": "2026-08-17T08:09:53.876Z",
"dateUpdated": "2026-08-27T12:05:30.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73812 (GCVE-0-2026-73812)
Vulnerability from cvelistv5 – Published: 2026-09-01 14:42 – Updated: 2026-09-08 01:10
VLAI
EPSS
VEX
Title
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
Summary
httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:56 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
EEF
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/erlang/otp/security/advisories… | vendor-advisory |
| https://cna.erlef.org/cves/CVE-2026-73812.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-73812 | related |
| https://github.com/erlang/otp/commit/591dc00dc99d… | patch |
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Erlang | OTP |
Unknown:
0 , < 17.0
(otp)
Affected: 17.0 , < 27.3.4.17 (otp) Affected: 28.0 , < 28.5.0.6 (otp) Affected: 29.0 , < 29.0.6 (otp) cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| Erlang | OTP |
Unknown:
0 , < 5.10
(otp)
Affected: 5.10 , < 9.3.2.7 (otp) Affected: 9.4 , < 9.6.2.3 (otp) Affected: 9.7 , < 9.7.2 (otp) cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| Erlang | OTP |
Affected:
84adefa331c4159d432d22840663c38f155cd4c1 , < 591dc00dc99dc2a426167a3b5257c0c94bd45e91
(git)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73812",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:56:32.935740Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:56:45.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"vendor": "Erlang",
"versions": [
{
"lessThan": "17.0",
"status": "unknown",
"version": "0",
"versionType": "otp"
},
{
"lessThan": "27.3.4.17",
"status": "affected",
"version": "17.0",
"versionType": "otp"
},
{
"lessThan": "28.5.0.6",
"status": "affected",
"version": "28.0",
"versionType": "otp"
},
{
"lessThan": "29.0.6",
"status": "affected",
"version": "29.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "inets",
"packageURL": "pkg:otp/inets",
"product": "OTP",
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"lessThan": "5.10",
"status": "unknown",
"version": "0",
"versionType": "otp"
},
{
"lessThan": "9.3.2.7",
"status": "affected",
"version": "5.10",
"versionType": "otp"
},
{
"lessThan": "9.6.2.3",
"status": "affected",
"version": "9.4",
"versionType": "otp"
},
{
"lessThan": "9.7.2",
"status": "affected",
"version": "9.7",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"lessThan": "591dc00dc99dc2a426167a3b5257c0c94bd45e91",
"status": "affected",
"version": "84adefa331c4159d432d22840663c38f155cd4c1",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.6",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.6",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Konrad Pietrzak / Ericsson"
},
{
"lang": "en",
"type": "finder",
"value": "Lukas Backstr\u00f6m / Erlang Solutions"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ehttpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;17.0 before OTP\u0026nbsp;27.3.4.17, from OTP\u0026nbsp;28.0 before OTP\u0026nbsp;28.5.0.6, and from OTP\u0026nbsp;29.0 before OTP\u0026nbsp;29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u0026nbsp;17.0, corresponding to inets before 5.10, is affected is unknown.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end\ndesync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
}
],
"value": "httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 \u00a76.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync.\n\nThis issue affects OTP from OTP\u00a017.0 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP\u00a017.0, corresponding to inets before 5.10, is affected is unknown."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T01:10:14.000Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-73812.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-73812"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-73812",
"datePublished": "2026-09-01T14:42:42.374Z",
"dateReserved": "2026-08-17T11:00:01.498Z",
"dateUpdated": "2026-09-08T01:10:14.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73548 (GCVE-0-2026-73548)
Vulnerability from cvelistv5 – Published: 2026-09-21 19:35 – Updated: 2026-09-24 22:35
VLAI
EPSS
VEX
Title
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
Summary
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker's response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-24 22:34 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
9 references
| URL | Tags |
|---|---|
| https://github.com/envoyproxy/envoy/security/advi… | x_refsource_CONFIRM |
| https://github.com/envoyproxy/envoy/commit/309855… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/commit/3c7998… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/commit/4633b8… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/commit/bd6711… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/releases/tag/… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/releases/tag/… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/releases/tag/… | x_refsource_MISC |
| https://github.com/envoyproxy/envoy/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| envoyproxy | envoy |
Affected:
< 1.36.10
Affected: >= 1.37.0, < 1.37.6 Affected: >= 1.38.0, < 1.38.4 Affected: >= 1.39.0, < 1.39.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73548",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T22:34:49.061262Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T22:35:14.446Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "envoy",
"vendor": "envoyproxy",
"versions": [
{
"status": "affected",
"version": "\u003c 1.36.10"
},
{
"status": "affected",
"version": "\u003e= 1.37.0, \u003c 1.37.6"
},
{
"status": "affected",
"version": "\u003e= 1.38.0, \u003c 1.38.4"
},
{
"status": "affected",
"version": "\u003e= 1.39.0, \u003c 1.39.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy forwards data for a configured non-WebSocket HTTP upgrade before the upstream accepts the upgrade. An unauthenticated HTTP/2 client can place a complete HTTP/1.1 request in extended CONNECT data; Envoy downgrades the request, writes the data unframed to a keep-alive HTTP/1.1 upstream, and returns the socket to the shared pool while the smuggled response remains queued. A different downstream client can then receive the attacker\u0027s response. The relevant scope boundary is that webSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection set to 1 are not affected by the demonstrated path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T19:35:15.275Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/envoyproxy/envoy/security/advisories/GHSA-3vhp-c83q-jqc2"
},
{
"name": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/commit/309855626966cff176155c821043ed3b44671361"
},
{
"name": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/commit/3c7998545a9c9fb3933a4bc1907d92f0e752bc2b"
},
{
"name": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/commit/4633b8cce3d15b8734eefe232e30c12b0140b91c"
},
{
"name": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/commit/bd6711f2617658e28dfa3df3dace6bfe3cfc0766"
},
{
"name": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.36.10"
},
{
"name": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.37.6"
},
{
"name": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.38.4"
},
{
"name": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/envoyproxy/envoy/releases/tag/v1.39.1"
}
],
"source": {
"advisory": "GHSA-3vhp-c83q-jqc2",
"discovery": "UNKNOWN"
},
"title": "Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy\u0027s shared backend pool"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73548",
"datePublished": "2026-09-21T19:35:15.275Z",
"dateReserved": "2026-08-12T20:53:46.379Z",
"dateUpdated": "2026-09-24T22:35:14.446Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73495 (GCVE-0-2026-73495)
Vulnerability from cvelistv5 – Published: 2026-08-12 21:11 – Updated: 2026-08-13 13:04
VLAI
EPSS
VEX
Title
blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)
Summary
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 13:02 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/http4s/blaze/security/advisori… | x_refsource_CONFIRM |
| https://github.com/http4s/blaze/commit/ef3e666c14… | x_refsource_MISC |
| https://github.com/http4s/blaze/releases/tag/v0.23.18 | x_refsource_MISC |
| https://github.com/http4s/blaze/releases/tag/v1.0.0-M42 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T13:02:55.958244Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:04:05.574Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "blaze",
"vendor": "http4s",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.18"
},
{
"status": "affected",
"version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M42"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject arbitrary header names and values, including X-Forwarded-For and internal authorization headers, that a fronting proxy sanitized from the request-header section, bypassing header-based trust decisions in the application. Any http4s application using BlazeServerBuilder over HTTP/1.1 whose routes or middleware trust proxy-set headers, including X-Forwarded-For, X-Real-IP, and X-Forwarded-Host, is affected. If a fronting proxy strips or normalizes those headers but forwards chunked bodies with trailers intact, an attacker can spoof client IP for allow-lists, rate limits, or auditing, forge the https scheme, or inject internal authorization headers. A promoted Connection: close trailer is also honored, allowing attacker-controlled termination of pooled backend connections. This issue is fixed in versions 0.23.18 and 1.0.0-M42."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T21:11:55.180Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/http4s/blaze/security/advisories/GHSA-46q4-43ph-c6fr"
},
{
"name": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/ef3e666c146cfc16cb6603f1fc3c464daab4a24f"
},
{
"name": "https://github.com/http4s/blaze/releases/tag/v0.23.18",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"
},
{
"name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"
}
],
"source": {
"advisory": "GHSA-46q4-43ph-c6fr",
"discovery": "UNKNOWN"
},
"title": "blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73495",
"datePublished": "2026-08-12T21:11:55.180Z",
"dateReserved": "2026-08-12T19:00:33.735Z",
"dateUpdated": "2026-08-13T13:04:05.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73494 (GCVE-0-2026-73494)
Vulnerability from cvelistv5 – Published: 2026-09-14 17:33 – Updated: 2026-09-14 20:05
VLAI
EPSS
VEX
Title
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
Summary
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:21 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
9 references
| URL | Tags |
|---|---|
| https://github.com/http4s/blaze/security/advisori… | x_refsource_CONFIRM |
| https://github.com/http4s/blaze/commit/3f7c022e30… | x_refsource_MISC |
| https://github.com/http4s/blaze/commit/4eec200780… | x_refsource_MISC |
| https://github.com/http4s/blaze/commit/927b67753a… | x_refsource_MISC |
| https://github.com/http4s/blaze/commit/a54bc9cd31… | x_refsource_MISC |
| https://github.com/http4s/blaze/commit/c47d9675f8… | x_refsource_MISC |
| https://github.com/http4s/blaze/commit/e871ebb1d2… | x_refsource_MISC |
| https://github.com/http4s/blaze/releases/tag/v0.23.18 | x_refsource_MISC |
| https://github.com/http4s/blaze/releases/tag/v1.0.0-M42 | x_refsource_MISC |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| http4s | blaze |
Affected:
< 0.23.18
Affected: >= 1.0.0-M1, < 1.0.0-M42 |
|
| org.http4s | blaze-http_2.13 |
Affected:
< 0.23.18
Affected: >= 1.0.0-M1, < 1.0.0-M42 |
|
| org.http4s | blaze-http_3 |
Affected:
< 0.23.18
Affected: >= 1.0.0-M1, < 1.0.0-M42 |
|
| org.http4s | http4s-blaze-server_2.13 |
Affected:
< 0.23.18
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:21:20.842876Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:05:52.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "blaze",
"vendor": "http4s",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.18"
},
{
"status": "affected",
"version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M42"
}
]
},
{
"product": "blaze-http_2.13",
"vendor": "org.http4s",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.18"
},
{
"status": "affected",
"version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M42"
}
]
},
{
"product": "blaze-http_3",
"vendor": "org.http4s",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.18"
},
{
"status": "affected",
"version": "\u003e= 1.0.0-M1, \u003c 1.0.0-M42"
}
]
},
{
"product": "http4s-blaze-server_2.13",
"vendor": "org.http4s",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.18"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T17:33:49.671Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/http4s/blaze/security/advisories/GHSA-mhvj-jhpq-885v",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/http4s/blaze/security/advisories/GHSA-mhvj-jhpq-885v"
},
{
"name": "https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/3f7c022e306631b006dcb43a1d7f65c0d1966f17"
},
{
"name": "https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/4eec2007806aa9acfefb00ebb636ddc39a147a96"
},
{
"name": "https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/927b67753a78c13c4445dac9307f511f5c4878c3"
},
{
"name": "https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/a54bc9cd31758335c7f24e29763622fd03fcf734"
},
{
"name": "https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/c47d9675f87603f11b32a11d503626bdf9be5c7a"
},
{
"name": "https://github.com/http4s/blaze/commit/e871ebb1d27f50c98fd56988526ce42d0fee74d6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/commit/e871ebb1d27f50c98fd56988526ce42d0fee74d6"
},
{
"name": "https://github.com/http4s/blaze/releases/tag/v0.23.18",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/releases/tag/v0.23.18"
},
{
"name": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/http4s/blaze/releases/tag/v1.0.0-M42"
}
],
"source": {
"advisory": "GHSA-mhvj-jhpq-885v",
"discovery": "UNKNOWN"
},
"title": "blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze\u0027s Java wire parser"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73494",
"datePublished": "2026-09-14T17:33:49.671Z",
"dateReserved": "2026-08-12T19:00:33.735Z",
"dateUpdated": "2026-09-14T20:05:52.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73276 (GCVE-0-2026-73276)
Vulnerability from cvelistv5 – Published: 2026-09-01 14:41 – Updated: 2026-09-08 01:10
VLAI
EPSS
VEX
Title
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
Summary
Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.
This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-01 15:55 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
EEF
CNA
References
6 references
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Erlang | OTP |
Affected:
22.2 , < 27.3.4.17
(otp)
Affected: 28.0 , < 28.5.0.6 (otp) Affected: 29.0 , < 29.0.6 (otp) cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| Erlang | OTP |
Affected:
7.1.2 , < 9.3.2.7
(otp)
Affected: 9.4 , < 9.6.2.3 (otp) Affected: 9.7 , < 9.7.2 (otp) cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
|
| Erlang | OTP |
Affected:
c06db0bedf49a9b40725745e73fa82e562612815 , < *
(git)
cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73276",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-01T15:55:23.919951Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-01T15:55:30.190Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "otp",
"packageURL": "pkg:software-id/erlang.org/otp",
"product": "OTP",
"vendor": "Erlang",
"versions": [
{
"lessThan": "27.3.4.17",
"status": "affected",
"version": "22.2",
"versionType": "otp"
},
{
"lessThan": "28.5.0.6",
"status": "affected",
"version": "28.0",
"versionType": "otp"
},
{
"lessThan": "29.0.6",
"status": "affected",
"version": "29.0",
"versionType": "otp"
}
]
},
{
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "inets",
"packageURL": "pkg:otp/inets",
"product": "OTP",
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"lessThan": "9.3.2.7",
"status": "affected",
"version": "7.1.2",
"versionType": "otp"
},
{
"lessThan": "9.6.2.3",
"status": "affected",
"version": "9.4",
"versionType": "otp"
},
{
"lessThan": "9.7.2",
"status": "affected",
"version": "9.7",
"versionType": "otp"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"packageName": "erlang/otp",
"packageURL": "pkg:github/erlang/otp",
"product": "OTP",
"repo": "https://github.com/erlang/otp",
"vendor": "Erlang",
"versions": [
{
"changes": [
{
"at": "60add5a19e2154560fdff3fe92dba14a68bbd683",
"status": "unaffected"
},
{
"at": "6cd995e34d3bb3d36dd278dded2d62c25e71820c",
"status": "unaffected"
},
{
"at": "c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f",
"status": "unaffected"
}
],
"lessThan": "*",
"status": "affected",
"version": "c06db0bedf49a9b40725745e73fa82e562612815",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "27.3.4.17",
"versionStartIncluding": "22.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "28.5.0.6",
"versionStartIncluding": "28.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "29.0.6",
"versionStartIncluding": "29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "Konrad Pietrzak / Ericsson"
},
{
"lang": "en",
"type": "reporter",
"value": "Lukas Backstr\u00f6m / Erlang Solutions"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eGracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\u003c/p\u003e\n\u003cp\u003eThis issue affects OTP from OTP\u0026nbsp;22.2 before OTP\u0026nbsp;27.3.4.17, from OTP\u0026nbsp;28.0 before OTP\u0026nbsp;28.5.0.6, and from OTP\u0026nbsp;29.0 before OTP\u0026nbsp;29.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2."
}
],
"value": "Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities.\n\nThis issue affects OTP from OTP\u00a022.2 before OTP\u00a027.3.4.17, from OTP\u00a028.0 before OTP\u00a028.5.0.6, and from OTP\u00a029.0 before OTP\u00a029.0.6, corresponding to inets from 7.1.2 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2."
}
],
"impacts": [
{
"capecId": "CAPEC-33",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-33 HTTP Request Smuggling"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-08T01:10:02.081Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p"
},
{
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-73276.html"
},
{
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-73276"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/6cd995e34d3bb3d36dd278dded2d62c25e71820c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i"
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-73276",
"datePublished": "2026-09-01T14:41:24.565Z",
"dateReserved": "2026-08-12T20:00:01.107Z",
"dateUpdated": "2026-09-08T01:10:02.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73257 (GCVE-0-2026-73257)
Vulnerability from cvelistv5 – Published: 2026-08-20 17:30 – Updated: 2026-08-20 19:34
VLAI
EPSS
VEX
Title
Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling
Summary
Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22.
Severity
9.1 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 19:34 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/cesanta/mongoose/security/advi… | x_refsource_CONFIRM |
| https://github.com/cesanta/mongoose/pull/3611 | x_refsource_MISC |
| https://github.com/cesanta/mongoose/commit/a9df52… | x_refsource_MISC |
| https://github.com/cesanta/mongoose/releases/tag/7.22 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73257",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T19:34:52.897430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T19:34:58.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "cesanta",
"versions": [
{
"status": "affected",
"version": "\u003c 7.22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in the mg_http_parse() and http_cb() paths in src/http.c accept both headers and prioritize chunked encoding, while a Content-Length-preferring reverse proxy can use a different request boundary. This CL.TE desynchronization can inject requests that access or modify resources in another user context. This issue is fixed in version 7.22."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T17:30:58.424Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-5wfq-r6mr-wqp6"
},
{
"name": "https://github.com/cesanta/mongoose/pull/3611",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cesanta/mongoose/pull/3611"
},
{
"name": "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"
},
{
"name": "https://github.com/cesanta/mongoose/releases/tag/7.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cesanta/mongoose/releases/tag/7.22"
}
],
"source": {
"advisory": "GHSA-5wfq-r6mr-wqp6",
"discovery": "UNKNOWN"
},
"title": "Mongoose: Content-Length + Transfer-Encoding coexistence enables request smuggling"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73257",
"datePublished": "2026-08-20T17:30:58.424Z",
"dateReserved": "2026-08-11T17:18:01.598Z",
"dateUpdated": "2026-08-20T19:34:58.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73256 (GCVE-0-2026-73256)
Vulnerability from cvelistv5 – Published: 2026-08-20 17:37 – Updated: 2026-08-21 21:46
VLAI
EPSS
VEX
Title
Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE
Summary
Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:10 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/cesanta/mongoose/security/advi… | x_refsource_CONFIRM |
| https://github.com/cesanta/mongoose/pull/3611 | x_refsource_MISC |
| https://github.com/cesanta/mongoose/commit/a9df52… | x_refsource_MISC |
| https://github.com/cesanta/mongoose/releases/tag/7.22 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73256",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:10:40.015064Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:46:47.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "mongoose",
"vendor": "cesanta",
"versions": [
{
"status": "affected",
"version": "\u003c 7.22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http_cb() function in src/http.c tests hm.proto.len with an impossible greater-than-eight condition even though mg_http_parse() requires an eight-byte protocol string, so is_http_1_0 is never set. Mongoose consequently processes chunked encoding that an HTTP/1.0 proxy can ignore, enabling request smuggling and unauthorized access or state changes. This issue is fixed in version 7.22."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T17:37:54.505Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/cesanta/mongoose/security/advisories/GHSA-mgp5-rjrv-h5j3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/cesanta/mongoose/security/advisories/GHSA-mgp5-rjrv-h5j3"
},
{
"name": "https://github.com/cesanta/mongoose/pull/3611",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cesanta/mongoose/pull/3611"
},
{
"name": "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cesanta/mongoose/commit/a9df523f76f43a38bd53b4232b9cfd4c16869e71"
},
{
"name": "https://github.com/cesanta/mongoose/releases/tag/7.22",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/cesanta/mongoose/releases/tag/7.22"
}
],
"source": {
"advisory": "GHSA-mgp5-rjrv-h5j3",
"discovery": "UNKNOWN"
},
"title": "Mongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TE"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-73256",
"datePublished": "2026-08-20T17:37:54.505Z",
"dateReserved": "2026-08-11T17:18:01.598Z",
"dateUpdated": "2026-08-21T21:46:47.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73051 (GCVE-0-2026-73051)
Vulnerability from cvelistv5 – Published: 2026-08-14 11:35 – Updated: 2026-10-29 21:16
VLAI
EPSS
VEX
Title
actix-http before 3.12.1 HTTP Request Smuggling via CL.TE
Summary
actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-14 13:58 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/actix/actix-web/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/actix-http-b… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| actix | actix-http |
Affected:
0 , < 3.12.1
(semver)
Unaffected: 3.12.1 (semver) cpe:2.3:a:actix:actix-http:*:*:*:*:*:rust:*:* |
Date Public
2026-04-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73051",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-14T13:58:45.453232Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T13:58:57.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:cargo/actix-http",
"product": "actix-http",
"vendor": "actix",
"versions": [
{
"lessThan": "3.12.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.12.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:actix:actix-http:*:*:*:*:*:rust:*:*",
"versionEndExcluding": "3.12.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "mufeedvh"
}
],
"datePublic": "2026-04-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backend requests and smuggle malicious HTTP requests to the Actix service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T21:16:52.750Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-xhj4-vrgc-hr34)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/actix/actix-web/security/advisories/GHSA-xhj4-vrgc-hr34"
},
{
"name": "VulnCheck Advisory: actix-http before 3.12.1 HTTP Request Smuggling via CL.TE",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/actix-http-before-http-request-smuggling-via-cl-te"
}
],
"title": "actix-http before 3.12.1 HTTP Request Smuggling via CL.TE",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-73051",
"datePublished": "2026-08-14T11:35:45.780Z",
"dateReserved": "2026-08-10T19:10:18.100Z",
"dateUpdated": "2026-10-29T21:16:52.750Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Mitigation
Implementation
Use only SSL communication.
Mitigation
Implementation
Terminate the client session after each request.
Mitigation
System Configuration
Turn all pages to non-cacheable.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.