Weaknesses of type CWE-444

320 results

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. O atacante injeta headers ou manipula o tamanho do corpo da requisição (via Content-Length ou Transfer-Encoding) para fazer o intermediário e o servidor final processar requisições distintas. Isso permite contornar controles de segurança, envenenar caches, sequestrar sessões de outros usuários ou executar ataques no servidor.

Example

Um atacante envia uma requisição com dois headers Content-Length conflitantes, ou mistura Content-Length com Transfer-Encoding chunked. O proxy interpreta o fim da requisição em um ponto, enquanto o servidor backend interpreta em outro, fazendo com que parte do payload do atacante seja concatenado à próxima requisição de um usuário legítimo.

How to mitigate

Normalize e valide rigorosamente headers HTTP (Content-Length, Transfer-Encoding) em proxies e servidores; use HTTP/2 ou HTTP/3 que mitigam o problema; mantenha proxy e backend sincronizados quanto à interpretação de requisições; desabilite HTTP/1.0 se possível e aplique filtros que rejeitem requisições ambíguas ou malformadas.

CVE-2023-33193CRITICALEmby Server Proxy Header Spoofing VulnerabilityEPSS 1.7%CVE-2024-23452HIGHApache bRPC: HTTP request smuggling vulnerabilityEPSS 1.6%CVE-2022-24766CRITICALInsufficient Protection against HTTP Request Smuggling in mitmproxyEPSS 1.6%CVE-2023-33934CRITICALApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesEPSS 1.6%CVE-2022-42252HIGHApache Tomcat request smuggling via malformed content-lengthEPSS 1.5%CVE-2022-45059HIGHAn issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish CacEPSS 1.5%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2017-12158—It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker cEPSS 1.3%CVE-2026-2332HIGHHTTP Request Smuggling via Chunked Extension Quoted-String ParsingEPSS 1.3%CVE-2021-41267MEDIUMWebcache Poisoning in SymfonyEPSS 1.3%CVE-2021-41136LOWInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in pumaEPSS 1.2%CVE-2023-29141CRITICALAn issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur EPSS 1.2%CVE-2024-34350HIGHNext.js Vulnerable to HTTP Request SmugglingEPSS 1.2%CVE-2022-0552—A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rEPSS 1.2%CVE-2025-31137HIGHRemix and React Router allow URL manipulation via Host / X-Forwarded-Host headersEPSS 1.2%CVE-2024-27982MEDIUMThe team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to EPSS 1.2%CVE-2026-48746CRITICALvLLM: OpenAI auth bypassEPSS 1.2%CVE-2020-10687—A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possEPSS 1.1%CVE-2021-20220—A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possiEPSS 1.1%CVE-2025-49826HIGHNext.js DoS vulnerability via cache poisoningEPSS 1.1%