cve.bz

CWE-444: Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling), page 5

Filter

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

What the weakness is: CWE-444 at MITRE. OWASP Top 10: A06:2025 Insecure Design

Related attack patterns (CAPEC): 2
  • CAPEC-33 HTTP Request Smuggling Likelihood: Medium · Severity: High
  • CAPEC-273 HTTP Response Smuggling Likelihood: Medium · Severity: High

The attack patterns MITRE's CAPEC relates to CWE-444, as MITRE names them. Credits.

Ask an AI about CWE-444

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-444: Inconsistent Interpretation of HTTP Requests and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/444.html and https://cve.bz/cve/cwe/444?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.3CVE-2025-59822EPSS 0.4%

    Http4s is a Scala interface for HTTP services. In versions from 1.0.0-M1 to before 1.0.0-M45 and before 0.23.31, http4s is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section. This vulnerability could enab…

  2. 6.9CVE-2025-6999EPSS 0.4%

    An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cross-Site Scripting (XSS) attack. WatchG…

  3. 9.8CVE-2025-56266ExploitEPSS 2.9%

    A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL.

  4. 2.9CVE-2025-58056EPSS 0.7%

    Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. In versions 4.1.124.Final, and 4.2.0.Alpha3 through 4.2.4.Final, Netty incorrectly accepts s…

  5. 6.3CVE-2025-58068EPSS 0.4%

    Eventlet is a concurrent networking library for Python. Prior to version 0.40.3, the Eventlet WSGI parser is vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sections. This vulnerability could enable attackers …

  6. 4.0CVE-2025-54142EPSS 0.3%

    Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if…

  7. 4.0CVE-2025-32094EPSS 0.6%

    An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding…

  8. 6.5CVE-2025-52892EPSS 0.3%

    EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and…

  9. 1.7CVE-2025-53643EPSS 0.4%

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pur…

  10. 6.3CVE-2025-53628EPSS 0.5%

    cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.20.1, cpp-httplib does not have a limit for a unique line, permitting an attacker to explore this to allocate memory arbitrarily. This vulnerabili…

  11. 7.5CVE-2025-49826EPSS 1.1%

    Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Denial of Service (DoS) condition was found in Next.js. This issue does not impact c…

  12. 3.7CVE-2025-49005EPSS 0.5%

    Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0, a cache poisoning vulnerability was found. The issue allowed page requests for …

  13. 5.9CVE-2025-6442EPSS 0.5%

    Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed …

  14. 8.6CVE-2025-41235EPSS 0.4%

    Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.

  15. 7.4CVE-2025-4366EPSS 0.5%

    A request smuggling vulnerability identified within Pingora’s proxying framework, pingora-proxy, allows malicious HTTP requests to be injected via manipulated request bodies on cache HITs, leading to unauthorized request execution and pote…

  16. 6.5CVE-2025-23167EPSS 0.5%

    A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using `\r\n\rX` instead of the required `\r\n\r\n`. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and…

  17. 8.7CVE-2025-4600EPSS 0.2%

    A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend ser…

  18. 5.4CVE-2025-47905EPSS 0.4%

    Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

  19. 9.1CVE-2024-56523EPSS 0.6%

    Radware Cloud Web Application Firewall (WAF) before 2025-05-07 allows remote attackers to bypass firewall filters by placing random data in the HTTP request body when using the HTTP GET method.

  20. 9.1CVE-2025-43859EPSS 0.6%

    h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has be…

  21. 7.7CVE-2024-33452EPSS 0.9%

    An issue in OpenResty lua-nginx-module v.0.10.26 and before allows a remote attacker to conduct HTTP request smuggling via a crafted HEAD request.

  22. 9.1CVE-2024-29643EPSS 0.6%

    An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.

  23. 5.9CVE-2025-1386EPSS 0.4%

    When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stre…

  24. 7.5CVE-2024-53868EPSS 0.7%

    Apache Traffic Server allows request smuggling if chunked messages are malformed.  This issue affects Apache Traffic Server: from 9.2.0 through 9.2.9, from 10.0.0 through 10.0.4. Users are recommended to upgrade to version 9.2.10 or …

  25. 7.5CVE-2025-31137EPSS 1.2%

    React Router is a multi-strategy router for React bridging the gap from React 18 to React 19. There is a vulnerability in Remix/React Router that affects all Remix 2 and React Router 7 consumers using the Express adapter. Basically, this v…

  26. 4.7CVE-2022-39163EPSS 0.2%

    IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.

  27. 4.8CVE-2025-30346EPSS 0.3%

    Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

  28. 7.5CVE-2024-6827EPSS 0.8%

    Gunicorn version 21.2.0 does not properly validate the value of the 'Transfer-Encoding' header as specified in the RFC standards, which leads to the default fallback method of 'Content-Length,' making it vulnerable to TE.CL request smuggli…

  29. 9.8CVE-2024-10264EPSS 1.0%

    HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing…

  30. 5.3CVE-2025-29904EPSS 0.3%

    In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible

  31. 10.0CVE-2025-1867EPSS 0.4%

    Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affects libhv: through 1.3.3.

  32. 6.8CVE-2024-56908EPSS 0.6%

    In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. By providing malicious input in the rel_id parameter, combined with improper input validation, the attacker c…

  33. 7.1CVE-2025-0752EPSS 0.4%

    A flaw was found in OpenShift Service Mesh 2.6.3 and 2.5.6. Rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks may be possible due to improper HTTP header sanitization in Envoy.

  34. 9.1CVE-2023-29476EPSS 0.4%

    In Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. This is fixed in 2.88.2+, 2.89.1+, and 2.90.1+.

  35. 7.4CVE-2024-12397EPSS 0.9%

    A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof …

  36. 5.3CVE-2024-53008EPSS 1.0%

    Inconsistent interpretation of HTTP requests ('HTTP Request/Response Smuggling') issue exists in HAProxy. If this vulnerability is exploited, a remote attacker may access a path that is restricted by ACL (Access Control List) set on the p…

  37. 4.7CVE-2024-9666EPSS 0.4%

    A vulnerability was found in the Keycloak Server. The Keycloak Server is vulnerable to a denial of service (DoS) attack due to improper handling of proxy headers. When Keycloak is configured to accept incoming proxy headers, it may accept …

  38. 6.3CVE-2024-52304EPSS 0.6%

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request smuggling vulnerabilities under certain c…

  39. 7.4CVE-2023-4639EPSS 1.1%

    A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbi…

  40. 7.5CVE-2024-52530EPSS 0.8%

    GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chun…

  41. 4.8CVE-2024-49768EPSS 0.5%

    Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is d…

  42. 7.5CVE-2024-44775EPSS 0.5%

    kmqtt v0.2.7 is vulnerable to Denial of Service (DoS) due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially crafted MQTT CONNECT packet that triggers an unhandled null reference, leading to…

  43. 5.3CVE-2024-21281EPSS 0.3%

    Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). The supported version that is affected is 14.7.0.6.0. Difficult to exploit vulnerability allows high …

  44. 8.9CVE-2024-8912EPSS 0.2%

    An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users. There are two Looker versions that are hosted by Looker: * Looker (Google Cloud core) was foun…

  45. 5.3CVE-2024-9622EPSS 0.6%

    A vulnerability was found in the resteasy-netty4 library arising from improper handling of HTTP requests using smuggling techniques. When an HTTP smuggling request with an ASCII control character is sent, it causes the Netty HttpObjectDeco…

  46. 5.3CVE-2024-8925EPSS 0.9%

    In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attac…

  47. 5.9CVE-2024-34535EPSS 0.4%

    In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.

  48. 5.4CVE-2024-45614EPSS 0.6%

    Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users…

  49. 4.3CVE-2024-42342EPSS 0.3%

    Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

  50. 9.1CVE-2024-27185EPSS 0.4%

    The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.