Weaknesses of type CWE-444

320 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2026-23941HIGHRequest smuggling via first-wins Content-Length parsing in inets httpdEPSS 0.5%CVE-2026-1760MEDIUMLibsoup: soupserver: denial of service via http request smugglingEPSS 0.4%CVE-2025-3110MEDIUMOpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HEPSS 0.4%CVE-2025-6999MEDIUMWatchGuard Firebox Authentication Portal Request Smuggling VulnerabilityEPSS 0.4%CVE-2026-41873CRITICALPony Mail: Admin account takeover via request smugglingEPSS 0.4%CVE-2026-71554MEDIUMh2: Duplicate Host header could facilitate request smugglingEPSS 0.4%CVE-2023-29476CRITICALIn Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. TEPSS 0.4%CVE-2024-27185CRITICAL[20240802] - Core - Cache Poisoning in PaginationEPSS 0.4%CVE-2026-33805CRITICAL@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headersEPSS 0.4%CVE-2026-54388CRITICALTinyproxy - HTTP Request Smuggling via Duplicate Content-Length HeadersEPSS 0.4%CVE-2026-54387CRITICALTinyproxy - HTTP Request Smuggling via CL/TE DesynchronizationEPSS 0.4%CVE-2026-69243MEDIUMAIOHTTP: HTTP request smuggling via WebSocket upgradeEPSS 0.4%CVE-2025-65114HIGHApache Traffic Server: Malformed chunked message body allows request smugglingEPSS 0.4%CVE-2026-29057MEDIUMNext.js: HTTP request smuggling in rewritesEPSS 0.4%CVE-2016-15039MEDIUMmhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smugglingEPSS 0.4%CVE-2026-9190CRITICALHTTP request smuggling in Progress MarkLogic ServerEPSS 0.4%CVE-2025-49005LOWNext.js cache poisoning due to omission of Vary headerEPSS 0.4%CVE-2026-75922MEDIUMReverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request lineEPSS 0.4%CVE-2026-11541HIGHInconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.EPSS 0.4%CVE-2026-67182MEDIUMRouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header InjectionEPSS 0.4%