Fallos del tipo CWE-444

323 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando proxies, load balancers ou firewalls interpretam requisições HTTP de forma diferente do servidor backend. Um atacante explora essa discrepância enviando requisições ambíguas (com headers conflitantes ou corpo malformado) que são parseadas de modos distintos por camadas diferentes da infraestrutura, permitindo contornar controles de segurança ou injetar requisições não autorizadas no backend.

Ejemplo

Um proxy usa Content-Length para determinar o fim da requisição, enquanto o servidor backend usa Transfer-Encoding: chunked. O atacante envia uma requisição que contém dois requests: um legítimo (que passa pelo proxy) e um malicioso embutido no corpo (que o backend processa como requisição separada). Resultado: bypass de WAF ou injeção de cache envenenado.

Cómo mitigar

Normalize o parsing: garanta que todas as camadas (proxy, load balancer, aplicação) usem as mesmas regras RFC 7230 para interpretar headers Content-Length e Transfer-Encoding; desabilite métodos ambíguos no proxy (reject requisições com ambos os headers); mantenha proxies e servidores sincronizados em versões e configurações de parsing HTTP.

CVE-2023-46121MEDIUMGeneric Extractor MITM Vulnerability in yt-dlpEPSS 0.3%CVE-2026-58055MEDIUMnghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-LengthEPSS 0.3%CVE-2024-21281MEDIUMVulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). ThEPSS 0.3%CVE-2026-72587MEDIUMInstatic - Cache Poisoning via Unauthenticated Server Island EndpointEPSS 0.3%CVE-2026-86350CRITICALApache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upEPSS 0.3%CVE-2025-53643LOWAIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsEPSS 0.3%CVE-2026-41853MEDIUMSpring Framework Multipart Request Smuggling in Spring MVC and WebFluxEPSS 0.3%CVE-2026-19203HIGHA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret difEPSS 0.3%CVE-2025-30346MEDIUMVarnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.EPSS 0.3%CVE-2026-48743HIGHEnvoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-LengthEPSS 0.3%CVE-2026-12606MEDIUMEclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveragEPSS 0.3%CVE-2023-30910MEDIUMHPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. EPSS 0.3%CVE-2026-79713MEDIUMBreeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersEPSS 0.3%CVE-2026-42585MEDIUMNetty: HTTP Request Smuggling due to malformed Transfer-EncodingEPSS 0.3%CVE-2026-64785MEDIUMSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 bacEPSS 0.3%CVE-2026-44546LOWHeader injection via WebSocket upgrade parser differential allows ASGI scope header spoofingEPSS 0.3%CVE-2024-42342MEDIUMLoway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')EPSS 0.3%CVE-2026-34441MEDIUMcpp-httplib: HTTP Request Smuggling via Unconsumed GET Request BodyEPSS 0.3%CVE-2026-66338MEDIUMLibsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()EPSS 0.3%CVE-2025-69225LOWAIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol FieldsEPSS 0.3%