CVE-2005-2093

no score yetEPSS 4.9%

oracle application server: no CVSS score yet. EPSS 4.9% chance of exploitation in the next 30 days.

Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Application Server to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

EPSS: 4.9% chance of exploitation in the next 30 days; higher than 92% of CVEs (scores of 2026-10-31)
Published: 2005-07-05
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

oracle:application_server

References

http://seclists.org/lists/bugtraq/2005/Jun/0025.html
http://www.securiteam.com/securityreviews/5GP0220G0U.html
http://www.watchfire.com/resources/HTTP-Request-Smuggling.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/42902
http://seclists.org/lists/bugtraq/2005/Jun/0025.html

Check your stack JSON