Fallos del tipo CWE-444

323 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando proxies, load balancers ou firewalls interpretam requisições HTTP de forma diferente do servidor backend. Um atacante explora essa discrepância enviando requisições ambíguas (com headers conflitantes ou corpo malformado) que são parseadas de modos distintos por camadas diferentes da infraestrutura, permitindo contornar controles de segurança ou injetar requisições não autorizadas no backend.

Ejemplo

Um proxy usa Content-Length para determinar o fim da requisição, enquanto o servidor backend usa Transfer-Encoding: chunked. O atacante envia uma requisição que contém dois requests: um legítimo (que passa pelo proxy) e um malicioso embutido no corpo (que o backend processa como requisição separada). Resultado: bypass de WAF ou injeção de cache envenenado.

Cómo mitigar

Normalize o parsing: garanta que todas as camadas (proxy, load balancer, aplicação) usem as mesmas regras RFC 7230 para interpretar headers Content-Length e Transfer-Encoding; desabilite métodos ambíguos no proxy (reject requisições com ambos os headers); mantenha proxies e servidores sincronizados em versões e configurações de parsing HTTP.

CVE-2017-7559—In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 wEPSS 1.7%CVE-2024-23452HIGHApache bRPC: HTTP request smuggling vulnerabilityEPSS 1.6%CVE-2022-24766CRITICALInsufficient Protection against HTTP Request Smuggling in mitmproxyEPSS 1.6%CVE-2023-33934CRITICALApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesEPSS 1.6%CVE-2022-42252HIGHApache Tomcat request smuggling via malformed content-lengthEPSS 1.5%CVE-2022-45059HIGHAn issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish CacEPSS 1.5%CVE-2023-37276MEDIUMaiohttp vulnerable to HTTP request smugglingEPSS 1.3%CVE-2026-2332HIGHHTTP Request Smuggling via Chunked Extension Quoted-String ParsingEPSS 1.3%CVE-2021-41267MEDIUMWebcache Poisoning in SymfonyEPSS 1.3%CVE-2021-41136LOWInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in pumaEPSS 1.2%CVE-2023-29141CRITICALAn issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur EPSS 1.2%CVE-2024-34350HIGHNext.js Vulnerable to HTTP Request SmugglingEPSS 1.2%CVE-2022-0552—A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rEPSS 1.2%CVE-2025-31137HIGHRemix and React Router allow URL manipulation via Host / X-Forwarded-Host headersEPSS 1.2%CVE-2024-27982MEDIUMThe team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to EPSS 1.2%CVE-2026-48746CRITICALvLLM: OpenAI auth bypassEPSS 1.2%CVE-2020-10687—A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possEPSS 1.1%CVE-2025-49826HIGHNext.js DoS vulnerability via cache poisoningEPSS 1.1%CVE-2021-20220—A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possiEPSS 1.1%CVE-2023-4639HIGHUndertow: cookie smuggling/spoofingEPSS 1.1%