Weaknesses of type CWE-444

322 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2026-14180MEDIUMUndertow-core: undertow:http request smuggling via oversized chunk-size bit overlapEPSS 0.4%CVE-2025-41082MEDIUMHTTP Request/Response Smuggling in Altitude Communication ServerEPSS 0.4%CVE-2025-0752HIGHEnvoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized accessEPSS 0.4%CVE-2026-58155CRITICALApache Traffic Server: Header-name length truncation enables header aliasing and request smugglingEPSS 0.4%CVE-2026-63385CRITICALLibevent: HTTP header handling bugs create risk of access control bypass.EPSS 0.4%CVE-2024-22279MEDIUMGoRouter Denial of Service AttackEPSS 0.4%CVE-2026-1801MEDIUMLibsoup: libsoup: http request smuggling via malformed chunk headersEPSS 0.4%CVE-2024-9666MEDIUMOrg.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerabilityEPSS 0.4%CVE-2026-50052LOWIn Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend requEPSS 0.4%CVE-2026-73256CRITICALMongoose: HTTP/1.0 detection off-by-one enables request smuggling via chunked TEEPSS 0.4%CVE-2026-69205HIGHHttp4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)EPSS 0.4%CVE-2026-1002MEDIUMEclipse Vert.x Web static handler file access denialEPSS 0.4%CVE-2025-58068MEDIUMEventlet affected by HTTP request smuggling in unparsed trailersEPSS 0.4%CVE-2025-1386MEDIUMQuery smuggling in ch-go libraryEPSS 0.4%CVE-2023-23691HIGH Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potenEPSS 0.4%CVE-2026-57834HIGHApache Traffic Server: Malformed chunked message body allows request smugglingEPSS 0.4%CVE-2025-1867CRITICALHTTP Response Smuggling Vulnerability in libhvEPSS 0.4%CVE-2024-34535MEDIUMIn Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.EPSS 0.4%CVE-2025-59822MEDIUMHttp4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer sectionEPSS 0.4%CVE-2026-73494HIGHblaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserEPSS 0.4%