Falhas do tipo CWE-444

323 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. Um atacante envia uma requisição ambígua que a camada intermediária processa como um pedido, mas o servidor entende como dois pedidos distintos — permitindo contornar controles de segurança, injetar requisições maliciosas ou sequestrar sessões de outros usuários.

Exemplo

Um proxy usa Content-Length para delimitar o corpo da requisição, enquanto o servidor backend prioriza Transfer-Encoding: chunked. O atacante envia um payload onde a primeira requisição termina segundo o proxy, mas o servidor vê uma segunda requisição oculta no corpo — essa segunda requisição pode roubar dados de sessão de outros usuários ou contornar WAF.

Como mitigar

Desabilite Transfer-Encoding: chunked em proxies se possível, normalize e valide rigorosamente headers HTTP (Content-Length e Transfer-Encoding não devem coexistir), mantenha proxy e servidor backend sincronizados em versão e configuração, e teste parsing ambíguo com ferramentas como http-request-smuggler.

CVE-2026-67181MEDIUMRouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding HeaderEPSS 0.3%CVE-2026-52845HIGHCaddy: FastCGI header normalization bypass in `forward_auth copy_headers`EPSS 0.3%CVE-2026-73495HIGHblaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)EPSS 0.3%CVE-2026-19203HIGHA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret difEPSS 0.3%CVE-2026-34525MEDIUMAIOHTTP: Duplicate Host header acceptedEPSS 0.3%CVE-2026-11710MEDIUMIBM WebSphere Application Server is affected by an HTTP request smuggling vulnerabilityEPSS 0.3%CVE-2024-42342MEDIUMLoway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')EPSS 0.3%CVE-2026-8620HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities when using when using Web Server Plug-insEPSS 0.3%CVE-2025-69225LOWAIOHTTP Regex Mismatch Allows Unicode in ASCII-Only Protocol FieldsEPSS 0.3%CVE-2026-20069MEDIUMCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling VulnerabilityEPSS 0.3%CVE-2026-88009HIGHTraefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access loggingEPSS 0.3%CVE-2026-48979HIGHPHP Standard Library: HTTP/2 server-side missing content-length validation enables request smugglingEPSS 0.3%CVE-2026-42585MEDIUMNetty: HTTP Request Smuggling due to malformed Transfer-EncodingEPSS 0.3%CVE-2025-54142MEDIUMAkamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequeEPSS 0.3%CVE-2026-51376MEDIUMAn issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesEPSS 0.3%CVE-2026-47676MEDIUMHono: app.mount() strips mount prefix using undecoded path, causing incorrect routing for percent-encoded pathsEPSS 0.3%CVE-2025-66373MEDIUMAkamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smugglEPSS 0.3%CVE-2026-53538LOWPython-Multipart: Semicolon treated as querystring field separator enables parameter smugglingEPSS 0.3%CVE-2026-6338MEDIUMHTTP request smuggling in Kong Enteprise GatewayEPSS 0.3%CVE-2026-58055MEDIUMnghttp2 nghttpx - HTTP Request/Response Smuggling via Upgrade Request with Content-LengthEPSS 0.3%