Fallos del tipo CWE-444

323 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando proxies, load balancers ou firewalls interpretam requisições HTTP de forma diferente do servidor backend. Um atacante explora essa discrepância enviando requisições ambíguas (com headers conflitantes ou corpo malformado) que são parseadas de modos distintos por camadas diferentes da infraestrutura, permitindo contornar controles de segurança ou injetar requisições não autorizadas no backend.

Ejemplo

Um proxy usa Content-Length para determinar o fim da requisição, enquanto o servidor backend usa Transfer-Encoding: chunked. O atacante envia uma requisição que contém dois requests: um legítimo (que passa pelo proxy) e um malicioso embutido no corpo (que o backend processa como requisição separada). Resultado: bypass de WAF ou injeção de cache envenenado.

Cómo mitigar

Normalize o parsing: garanta que todas as camadas (proxy, load balancer, aplicação) usem as mesmas regras RFC 7230 para interpretar headers Content-Length e Transfer-Encoding; desabilite métodos ambíguos no proxy (reject requisições com ambos os headers); mantenha proxies e servidores sincronizados em versões e configurações de parsing HTTP.

CVE-2025-55018MEDIUMAn inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.EPSS 0.4%CVE-2025-47905MEDIUMVarnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, becaEPSS 0.4%CVE-2026-42580MEDIUMNetty: HTTP Request Smuggling due to incorrect chunk size parsingEPSS 0.4%CVE-2026-84380MEDIUMHTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generatedEPSS 0.4%CVE-2026-32239MEDIUMCap'n Proto has an integer overflow in KJ-HTTPEPSS 0.4%CVE-2026-32240MEDIUMCap'n Proto: Integer overflow in KJ-HTTP chunk sizeEPSS 0.4%CVE-2024-14029CRITICALTornado before 6.4.1 HTTP Request Smuggling via Transfer-EncodingEPSS 0.4%CVE-2026-65370HIGHServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is EPSS 0.3%CVE-2025-41235HIGHCVE-2025-41235: Spring Cloud Gateway Server Forwards Headers from Untrusted ProxiesEPSS 0.3%CVE-2025-12642MEDIUMHTTP Header Smuggling via Trailer MergeEPSS 0.3%CVE-2025-12811MEDIUMCloud Suite and Privilege Access Service– HTTP request smuggling vulnerabilityEPSS 0.3%CVE-2026-15064HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-15325HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-78605MEDIUMInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information DisclosureEPSS 0.3%CVE-2026-41417MEDIUMNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()EPSS 0.3%CVE-2026-4742LOWHTTP Request Smuggling in visualfc/liteideEPSS 0.3%CVE-2026-47676MEDIUMHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsEPSS 0.3%CVE-2026-66752MEDIUMtiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding HandlingEPSS 0.3%CVE-2025-29904MEDIUMIn JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleEPSS 0.3%CVE-2025-11915MEDIUMHTTP Desynchronisation in Vertex AI for certain third-party modelsEPSS 0.3%