Weaknesses of type CWE-444

323 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2026-67181MEDIUMRouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding HeaderEPSS 0.3%CVE-2026-52845HIGHCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`EPSS 0.3%CVE-2026-73495HIGHblaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)EPSS 0.3%CVE-2026-19203HIGHA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret difEPSS 0.3%CVE-2026-34525MEDIUMAIOHTTP: Duplicate Host header acceptedEPSS 0.3%CVE-2026-11710MEDIUMIBM WebSphere Application Server is affected by an HTTP request smuggling vulnerabilityEPSS 0.3%CVE-2024-42342MEDIUMLoway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')EPSS 0.3%CVE-2026-8620HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-insEPSS 0.3%CVE-2025-69225LOWAIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol FieldsEPSS 0.3%CVE-2026-20069MEDIUMCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling VulnerabilityEPSS 0.3%CVE-2026-88009HIGHTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingEPSS 0.3%CVE-2026-48979HIGHPHP Standard Library: HTTP/2 server-side missing content-length validation enables request smugglingEPSS 0.3%CVE-2026-42585MEDIUMNetty: HTTP Request Smuggling due to malformed Transfer-EncodingEPSS 0.3%CVE-2025-54142MEDIUMAkamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequeEPSS 0.3%CVE-2026-51376MEDIUMAn issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesEPSS 0.3%CVE-2026-47676MEDIUMHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsEPSS 0.3%CVE-2025-66373MEDIUMAkamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smugglEPSS 0.3%CVE-2026-53538LOWPython-Multipart: Semicolon treated as querystring field separator enables parameter smugglingEPSS 0.3%CVE-2026-6338MEDIUMHTTP request smuggling in Kong Enteprise GatewayEPSS 0.3%CVE-2026-58055MEDIUMnghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-LengthEPSS 0.3%