Weaknesses of type CWE-444

322 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2026-73276HIGHinets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping iEPSS 0.3%CVE-2026-24033MEDIUMApache Traffic Server: Request smuggling via chunked extension quoted-string parsingEPSS 0.3%CVE-2025-29904MEDIUMIn JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleEPSS 0.3%CVE-2025-11915MEDIUMHTTP Desynchronisation in Vertex AI for certain third-party modelsEPSS 0.3%CVE-2026-81356HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-2708LOWLibsoup: libsoup: http request smuggling via duplicate content-length headersEPSS 0.3%CVE-2023-46121MEDIUMGeneric Extractor MITM Vulnerability in yt-dlpEPSS 0.3%CVE-2026-40562HIGHGazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceEPSS 0.3%CVE-2026-41417MEDIUMNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()EPSS 0.3%CVE-2025-53643LOWAIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsEPSS 0.3%CVE-2025-30346MEDIUMVarnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.EPSS 0.3%CVE-2026-49753MEDIUMHTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsingEPSS 0.3%CVE-2026-73812HIGHinets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-LengthEPSS 0.3%CVE-2026-82672MEDIUMUnvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connectionsEPSS 0.3%CVE-2024-21281MEDIUMVulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). ThEPSS 0.3%CVE-2026-48743HIGHEnvoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-LengthEPSS 0.3%CVE-2026-12606MEDIUMEclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveragEPSS 0.3%CVE-2026-85078MEDIUMsanic chunked trailer request smuggling allows hidden second request executionEPSS 0.3%CVE-2026-45372CRITICALcpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injectionEPSS 0.3%CVE-2023-30910MEDIUMHPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. EPSS 0.3%