Fallos del tipo CWE-444

323 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando proxies, load balancers ou firewalls interpretam requisições HTTP de forma diferente do servidor backend. Um atacante explora essa discrepância enviando requisições ambíguas (com headers conflitantes ou corpo malformado) que são parseadas de modos distintos por camadas diferentes da infraestrutura, permitindo contornar controles de segurança ou injetar requisições não autorizadas no backend.

Ejemplo

Um proxy usa Content-Length para determinar o fim da requisição, enquanto o servidor backend usa Transfer-Encoding: chunked. O atacante envia uma requisição que contém dois requests: um legítimo (que passa pelo proxy) e um malicioso embutido no corpo (que o backend processa como requisição separada). Resultado: bypass de WAF ou injeção de cache envenenado.

Cómo mitigar

Normalize o parsing: garanta que todas as camadas (proxy, load balancer, aplicação) usem as mesmas regras RFC 7230 para interpretar headers Content-Length e Transfer-Encoding; desabilite métodos ambíguos no proxy (reject requisições com ambos os headers); mantenha proxies e servidores sincronizados em versões e configurações de parsing HTTP.

CVE-2026-20069MEDIUMCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling VulnerabilityEPSS 0.3%CVE-2026-58044LOWA flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from EPSS 0.3%CVE-2026-48932LOWA flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from EPSS 0.3%CVE-2026-26365MEDIUMAkamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming requestEPSS 0.3%CVE-2025-54142MEDIUMAkamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequeEPSS 0.3%CVE-2025-66373MEDIUMAkamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smugglEPSS 0.3%CVE-2026-53538LOWPython-Multipart: Semicolon treated as querystring field separator enables parameter smugglingEPSS 0.3%CVE-2026-77756LOWApache Tomcat: Transfer-Encoding honored for HTTP/1.0 requestsEPSS 0.3%CVE-2026-15396MEDIUMIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-15634MEDIUMIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2025-52892MEDIUMEspoCRM is vulnerable to access denial through double slash in URI corrupting router cacheEPSS 0.2%CVE-2025-69224MEDIUMAIOHTTP's Unicode processing of header values could cause parsing discrepanciesEPSS 0.2%CVE-2026-18540LOWundici vulnerable to downstream response splitting via retry interceptorEPSS 0.2%CVE-2026-11710MEDIUMIBM WebSphere Application Server is affected by an HTTP request smuggling vulnerabilityEPSS 0.2%CVE-2025-4600HIGHHTTP Request Smuggling in Google Cloud Classic Application Load Balancer due to Improper Chunked Encoding ValidationEPSS 0.2%CVE-2022-39163MEDIUMIBM Cognos Controller HTTP response smugglingEPSS 0.2%CVE-2024-8912HIGHHTTP Request Smuggling in LookerEPSS 0.2%CVE-2026-11548MEDIUMMultiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.EPSS 0.2%CVE-2026-11722MEDIUMMultiple security vulnerabilities may affect IBM WebSphere Liberty that is shipped with IBM CICS TX Advanced.EPSS 0.2%CVE-2025-31958LOWHCL BigFix Service Management (SM) is susceptible to HTTP Request SmugglingEPSS 0.2%