cve.bz

CWE-444: Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling), page 2

Filter

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

What the weakness is: CWE-444 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 2
  • CAPEC-33 HTTP Request Smuggling Likelihood: Medium · Severity: High
  • CAPEC-273 HTTP Response Smuggling Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-444, as MITRE names them. Credits.

Ask an AI about CWE-444

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-444: Inconsistent Interpretation of HTTP Requests and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/444.html and https://cve.bz/cve/cwe/444?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-93569EPSS 2.2%

    A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Ne…

  2. 6.5CVE-2026-79713EPSS 0.3%

    The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered und…

  3. 6.5CVE-2026-85078EPSS 0.5%

    Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A…

  4. 9.8CVE-2026-92238EPSS 0.5%

    A maliciously constructed mail header could lead to multiple fields being parsed as one, or potential memory safety violations. This vulnerability was fixed in Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.

  5. 8.7CVE-2026-69217EPSS 0.5%

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and uses the last value instead of rejecting the message. When an Ember server is beh…

  6. 8.7CVE-2026-69205EPSS 0.5%

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Encoding value and decodes header bytes with the platform default charset. Values su…

  7. 5.4CVE-2026-69216EPSS 0.4%

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or minus signs instead of requiring one or more hexadecimal digits followed by the req…

  8. 9.2CVE-2026-69204EPSS 0.6%

    Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Content-Length, so an intermediary and Ember can select different body framing rul…

  9. 9.0CVE-2024-14029EPSS 0.4%

    Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed …

  10. 9.0CVE-2023-54397EPSS 0.4%

    Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy valid…

  11. 6.5CVE-2026-15634EPSS 0.4%

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By se…

  12. 6.5CVE-2026-15396EPSS 0.4%

    IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By se…

  13. 7.4CVE-2026-73494EPSS 0.6%

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/h…

  14. 6.9CVE-2026-89044EPSS 0.3%

    Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding in the Transfer-Encoding header, allowing attackers to smuggle requests by using malformed encodin…

  15. 9.1CVE-2026-68006EPSS 0.5%

    An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

  16. 8.8CVE-2026-88009EPSS 0.4%

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evalua…

  17. 7.0CVE-2026-88008EPSS 0.5%

    Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend.…

  18. 8.2CVE-2026-81356EPSS 0.5%

    Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

  19. 8.3CVE-2026-19203EPSS 0.3%

    A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by J…

  20. 3.7CVE-2026-18540EPSS 0.3%

    undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. This happens when an upstream server d…

  21. 5.6CVE-2026-84380EPSS 0.2%

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding hea…

  22. 5.9CVE-2026-84363EPSS 0.4%

    Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read req…

  23. 5.9CVE-2026-78605EPSS 0.3%

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker…

  24. 8.3CVE-2026-73812EPSS 0.5%

    httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently disc…

  25. 8.3CVE-2026-73276EPSS 0.6%

    Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP 22.2 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OT…

  26. 8.3CVE-2026-66357EPSS 0.6%

    httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understand…

  27. 3.7CVE-2026-48932EPSS 0.3%

    A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection…

  28. 6.5CVE-2026-51376EPSS 0.4%

    An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache

  29. 7.0CVE-2026-74848EPSS 0.6%

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This …

  30. 5.3CVE-2026-75922EPSS 0.4%

    Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line. PSGI hands PATH_INFO to an application percent-decoded, so a %XX sequence in the cli…

  31. 9.1CVE-2026-73257EPSS 0.7%

    Mongoose is an embedded web server and network library. Priro to version 7.22, a remote unauthenticated attacker can send an HTTP request containing both Content-Length and Transfer-Encoding: chunked. The cl_count and te_count checks in th…

  32. 9.1CVE-2026-73256EPSS 0.4%

    Mongoose is an embedded web server and network library. Prior to 7.22, a remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The htt…

  33. 9.2CVE-2026-63385EPSS 1.3%

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downs…

  34. 9.2CVE-2026-63382EPSS 0.8%

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in c…

  35. 6.3CVE-2026-63379EPSS 0.7%

    Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ …

  36. 6.1CVE-2026-55087ExploitEPSS 0.6%

    Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin …

  37. 6.3CVE-2026-73051EPSS 0.6%

    actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit th…

  38. 7.4CVE-2026-73495EPSS 0.5%

    blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker…

  39. 7.5CVE-2026-65370EPSS 0.3%

    ServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is addressed in servicetalk version 0.42.65.

  40. 5.9CVE-2026-62899EPSS 0.7%

    Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.

  41. 5.3CVE-2026-14180EPSS 1.0%

    A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the re…

  42. 6.1CVE-2026-72587EPSS 0.3%

    A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query parameter of the GET /_instatic/hole/<nodeId> server …

  43. 5.3CVE-2026-71554EPSS 0.4%

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the cons…

  44. 7.0CVE-2026-71324EPSS 1.1%

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shar…

  45. 9.1CVE-2026-9190EPSS 0.7%

    An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture…

  46. 3.7CVE-2026-58044EPSS 0.3%

    A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection…

  47. 6.3CVE-2026-69243EPSS 0.4%

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker…

  48. 5.6CVE-2026-58047EPSS 0.5%

    HTTP Smuggling in cPanel allows potential leak of credentials.

  49. 6.5CVE-2026-16728EPSS 0.3%

    undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0,…

  50. 6.3CVE-2026-59898EPSS 0.4%

    Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and …