Weaknesses of type CWE-444

365 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2026-115823CRITICALStarman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connectionsEPSS 0.4%CVE-2025-31699CRITICALApache Traffic Server: Origin connection still owed a request body is reused, enabling request smugglingEPSS 0.3%CVE-2026-65370HIGHServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is EPSS 0.3%CVE-2026-100724MEDIUMhttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyEPSS 0.3%CVE-2026-15064HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2023-30910MEDIUMHPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. EPSS 0.3%CVE-2026-15325HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-78605MEDIUMInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information DisclosureEPSS 0.3%CVE-2026-102479HIGHIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well kEPSS 0.3%CVE-2026-57488HIGHpupnp: Integer truncation in HTTP Content-Length parsing enables request smugglingEPSS 0.3%CVE-2025-29904MEDIUMIn JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleEPSS 0.3%CVE-2026-93003MEDIUMNetX Duo Web HTTP server interprets request body content as HTTP header fieldsEPSS 0.3%CVE-2026-66752MEDIUMtiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding HandlingEPSS 0.3%CVE-2025-55702HIGHApache Traffic Server: An unread Expect: 100-continue request body is framed as a new requestEPSS 0.3%CVE-2025-11915MEDIUMHTTP Desynchronisation in Vertex AI for certain third-party modelsEPSS 0.3%CVE-2026-116127CRITICALStarlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connectionEPSS 0.3%CVE-2023-46121MEDIUMGeneric Extractor MITM Vulnerability in yt-dlpEPSS 0.3%CVE-2026-2708LOWLibsoup: libsoup: http request smuggling via duplicate content-length headersEPSS 0.3%CVE-2026-40562HIGHGazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceEPSS 0.3%CVE-2026-41417MEDIUMNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()EPSS 0.3%