Falhas do tipo CWE-444

365 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. Um atacante envia uma requisição ambígua que a camada intermediária processa como um pedido, mas o servidor entende como dois pedidos distintos — permitindo contornar controles de segurança, injetar requisições maliciosas ou sequestrar sessões de outros usuários.

Exemplo

Um proxy usa Content-Length para delimitar o corpo da requisição, enquanto o servidor backend prioriza Transfer-Encoding: chunked. O atacante envia um payload onde a primeira requisição termina segundo o proxy, mas o servidor vê uma segunda requisição oculta no corpo — essa segunda requisição pode roubar dados de sessão de outros usuários ou contornar WAF.

Como mitigar

Desabilite Transfer-Encoding: chunked em proxies se possível, normalize e valide rigorosamente headers HTTP (Content-Length e Transfer-Encoding não devem coexistir), mantenha proxy e servidor backend sincronizados em versão e configuração, e teste parsing ambíguo com ferramentas como http-request-smuggler.

CVE-2026-115823CRITICALStarman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connectionsEPSS 0.4%CVE-2025-31699CRITICALApache Traffic Server: Origin connection still owed a request body is reused, enabling request smugglingEPSS 0.3%CVE-2026-65370HIGHServiceTalk HTTP/1.x incorrectly handles malformed Transfer-Encoding which could result in request smuggling attacks. This vulnerability is EPSS 0.3%CVE-2026-100724MEDIUMhttp4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyEPSS 0.3%CVE-2026-15064HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2023-30910MEDIUMHPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. EPSS 0.3%CVE-2026-15325HIGHIBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesEPSS 0.3%CVE-2026-78605MEDIUMInconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch Leading to Information DisclosureEPSS 0.3%CVE-2026-102479HIGHIn Eclipse Vert.x versions [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x HTTP/1.x decoder uses a canonicalization for well kEPSS 0.3%CVE-2026-57488HIGHpupnp: Integer truncation in HTTP Content-Length parsing enables request smugglingEPSS 0.3%CVE-2025-29904MEDIUMIn JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleEPSS 0.3%CVE-2026-93003MEDIUMNetX Duo Web HTTP server interprets request body content as HTTP header fieldsEPSS 0.3%CVE-2026-66752MEDIUMtiny-http 0.12.0 HTTP Request Smuggling via Transfer-Encoding HandlingEPSS 0.3%CVE-2025-55702HIGHApache Traffic Server: An unread Expect: 100-continue request body is framed as a new requestEPSS 0.3%CVE-2025-11915MEDIUMHTTP Desynchronisation in Vertex AI for certain third-party modelsEPSS 0.3%CVE-2026-116127CRITICALStarlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connectionEPSS 0.3%CVE-2023-46121MEDIUMGeneric Extractor MITM Vulnerability in yt-dlpEPSS 0.3%CVE-2026-2708LOWLibsoup: libsoup: http request smuggling via duplicate content-length headersEPSS 0.3%CVE-2026-40562HIGHGazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header PrecedenceEPSS 0.3%CVE-2026-41417MEDIUMNetty vulnerable to HTTP request smuggling and RTSP request injection via DefaultHttpRequest.setUri()EPSS 0.3%