Fallos del tipo CWE-444

323 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando proxies, load balancers ou firewalls interpretam requisições HTTP de forma diferente do servidor backend. Um atacante explora essa discrepância enviando requisições ambíguas (com headers conflitantes ou corpo malformado) que são parseadas de modos distintos por camadas diferentes da infraestrutura, permitindo contornar controles de segurança ou injetar requisições não autorizadas no backend.

Ejemplo

Um proxy usa Content-Length para determinar o fim da requisição, enquanto o servidor backend usa Transfer-Encoding: chunked. O atacante envia uma requisição que contém dois requests: um legítimo (que passa pelo proxy) e um malicioso embutido no corpo (que o backend processa como requisição separada). Resultado: bypass de WAF ou injeção de cache envenenado.

Cómo mitigar

Normalize o parsing: garanta que todas as camadas (proxy, load balancer, aplicação) usem as mesmas regras RFC 7230 para interpretar headers Content-Length e Transfer-Encoding; desabilite métodos ambíguos no proxy (reject requisições com ambos os headers); mantenha proxies e servidores sincronizados em versões e configurações de parsing HTTP.

CVE-2025-6999MEDIUMWatchGuard Firebox Authentication Portal Request Smuggling VulnerabilityEPSS 0.4%CVE-2026-88009HIGHTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingEPSS 0.4%CVE-2023-29476CRITICALIn Menlo On-Premise Appliance before 2.88, web policy may not be consistently applied properly to intentionally malformed client requests. TEPSS 0.4%CVE-2026-69243MEDIUMAIOHTTP: HTTP request smuggling via WebSocket upgradeEPSS 0.4%CVE-2024-27185CRITICAL[20240802] - Core - Cache Poisoning in PaginationEPSS 0.4%CVE-2026-59898MEDIUMNetty: WebSockets V07/V08 handshaker missing Connection/Upgrade validationEPSS 0.4%CVE-2025-41082MEDIUMHTTP Request/Response Smuggling in Altitude Communication ServerEPSS 0.4%CVE-2026-40561MEDIUMStarlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceEPSS 0.4%CVE-2025-65114HIGHApache Traffic Server: Malformed chunked message body allows request smugglingEPSS 0.4%CVE-2026-6338MEDIUMHTTP request smuggling in Kong Enteprise GatewayEPSS 0.4%CVE-2026-89044MEDIUMNetty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-EncodingEPSS 0.4%CVE-2016-15039MEDIUMmhuertos phpLDAPadmin ajax_functions.js makeHttpRequest request smugglingEPSS 0.4%CVE-2026-75922MEDIUMReverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request lineEPSS 0.4%CVE-2026-71554MEDIUMh2: Duplicate Host header could facilitate request smugglingEPSS 0.4%CVE-2026-11541HIGHInconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.EPSS 0.4%CVE-2026-67181MEDIUMRouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding HeaderEPSS 0.4%CVE-2026-45372CRITICALcpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injectionEPSS 0.4%CVE-2025-0752HIGHEnvoyproxy: openshift service mesh envoy http header sanitization bypass leading to dos and unauthorized accessEPSS 0.4%CVE-2024-22279MEDIUMGoRouter Denial of Service AttackEPSS 0.4%CVE-2026-2708LOWLibsoup: libsoup: http request smuggling via duplicate content-length headersEPSS 0.4%