Weaknesses of type CWE-444

365 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2026-69217HIGHHttp4s: Ember Server accepts duplicate Content-Length headersEPSS 0.5%CVE-2025-12874MEDIUMHTTP Request Smuggling in Quest Coexistence Manager for NotesEPSS 0.5%CVE-2025-6442MEDIUMRuby WEBrick read_header HTTP Request Smuggling VulnerabilityEPSS 0.5%CVE-2024-20915MEDIUMVulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions thatEPSS 0.5%CVE-2025-49005LOWNext.js cache poisoning due to omission of Vary headerEPSS 0.5%CVE-2026-88008HIGHTraefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect AuthorizationEPSS 0.5%CVE-2026-40560HIGHStarman versions before 0.4018 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceEPSS 0.5%CVE-2024-49768CRITICALWaitress has request processing race condition in HTTP pipelining with invalid first requestEPSS 0.5%CVE-2026-86350CRITICALApache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upEPSS 0.5%CVE-2026-23941HIGHRequest smuggling via first-wins Content-Length parsing in inets httpdEPSS 0.5%CVE-2026-73495HIGHblaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)EPSS 0.5%CVE-2026-69205HIGHHttp4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)EPSS 0.5%CVE-2023-51701MEDIUM@fastify-reply-from JSON Content-Type parsing confusionEPSS 0.5%CVE-2023-49584MEDIUMClient-Side Desynchronization vulnerability in SAP Fiori LaunchpadEPSS 0.5%CVE-2026-1760MEDIUMLibsoup: soupserver: denial of service via http request smugglingEPSS 0.5%CVE-2026-11806HIGHIBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerabilityEPSS 0.5%CVE-2023-52354HIGHchasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.EPSS 0.5%CVE-2026-73548HIGHEnvoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend poolEPSS 0.5%CVE-2026-29057MEDIUMNext.js: HTTP request smuggling in rewritesEPSS 0.5%CVE-2023-50811MEDIUMAn issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a EPSS 0.5%