Falhas do tipo CWE-444

322 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. Um atacante envia uma requisição ambígua que a camada intermediária processa como um pedido, mas o servidor entende como dois pedidos distintos — permitindo contornar controles de segurança, injetar requisições maliciosas ou sequestrar sessões de outros usuários.

Exemplo

Um proxy usa Content-Length para delimitar o corpo da requisição, enquanto o servidor backend prioriza Transfer-Encoding: chunked. O atacante envia um payload onde a primeira requisição termina segundo o proxy, mas o servidor vê uma segunda requisição oculta no corpo — essa segunda requisição pode roubar dados de sessão de outros usuários ou contornar WAF.

Como mitigar

Desabilite Transfer-Encoding: chunked em proxies se possível, normalize e valide rigorosamente headers HTTP (Content-Length e Transfer-Encoding não devem coexistir), mantenha proxy e servidor backend sincronizados em versão e configuração, e teste parsing ambíguo com ferramentas como http-request-smuggler.

CVE-2026-73276HIGHinets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping iEPSS 0.3%CVE-2026-24033MEDIUMApache Traffic Server: Request smuggling via chunked extension quoted-string parsingEPSS 0.3%CVE-2025-29904MEDIUMIn JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleEPSS 0.3%CVE-2025-11915MEDIUMHTTP Desynchronisation in Vertex AI for certain third-party modelsEPSS 0.3%CVE-2026-81356HIGHVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.3%CVE-2026-2708LOWLibsoup: libsoup: http request smuggling via duplicate content-length headersEPSS 0.3%CVE-2023-46121MEDIUMGeneric Extractor MITM Vulnerability in yt-dlpEPSS 0.3%CVE-2026-40562HIGHGazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceEPSS 0.3%CVE-2026-41417MEDIUMNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()EPSS 0.3%CVE-2025-53643LOWAIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sectionsEPSS 0.3%CVE-2025-30346MEDIUMVarnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.EPSS 0.3%CVE-2026-49753MEDIUMHTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsingEPSS 0.3%CVE-2026-73812HIGHinets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-LengthEPSS 0.3%CVE-2026-82672MEDIUMUnvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connectionsEPSS 0.3%CVE-2024-21281MEDIUMVulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). ThEPSS 0.3%CVE-2026-48743HIGHEnvoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-LengthEPSS 0.3%CVE-2026-12606MEDIUMEclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveragEPSS 0.3%CVE-2026-85078MEDIUMsanic chunked trailer request smuggling allows hidden second request executionEPSS 0.3%CVE-2026-45372CRITICALcpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injectionEPSS 0.3%CVE-2023-30910MEDIUMHPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. EPSS 0.3%