Falhas do tipo CWE-444

365 resultados

Interpretação inconsistente de requisições HTTP (HTTP Request Smuggling)

Ocorre quando um proxy, load balancer ou firewall interpreta uma requisição HTTP de forma diferente do servidor backend. Um atacante envia uma requisição ambígua que a camada intermediária processa como um pedido, mas o servidor entende como dois pedidos distintos — permitindo contornar controles de segurança, injetar requisições maliciosas ou sequestrar sessões de outros usuários.

Exemplo

Um proxy usa Content-Length para delimitar o corpo da requisição, enquanto o servidor backend prioriza Transfer-Encoding: chunked. O atacante envia um payload onde a primeira requisição termina segundo o proxy, mas o servidor vê uma segunda requisição oculta no corpo — essa segunda requisição pode roubar dados de sessão de outros usuários ou contornar WAF.

Como mitigar

Desabilite Transfer-Encoding: chunked em proxies se possível, normalize e valide rigorosamente headers HTTP (Content-Length e Transfer-Encoding não devem coexistir), mantenha proxy e servidor backend sincronizados em versão e configuração, e teste parsing ambíguo com ferramentas como http-request-smuggler.

CVE-2024-21281MEDIUMVulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications (component: Infrastructure). ThEPSS 0.3%CVE-2026-20069MEDIUMCisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software VPN Web Services Client-Side Request Smuggling VulnerabilityEPSS 0.3%CVE-2026-72587MEDIUMInstatic - Cache Poisoning via Unauthenticated Server Island EndpointEPSS 0.3%CVE-2025-30346MEDIUMVarnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.EPSS 0.3%CVE-2026-18540LOWundici vulnerable to downstream response splitting via retry interceptorEPSS 0.3%CVE-2026-111816CRITICALApache Traffic Server: A malformed 302 response bypasses parse-error rejection through the Transfer-Encoding: chunked carve-outEPSS 0.3%CVE-2026-19203HIGHA client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret difEPSS 0.3%CVE-2026-49753MEDIUMHTTP response smuggling in Mint HTTP/1 client via lenient Content-Length parsingEPSS 0.3%CVE-2026-34525MEDIUMAIOHTTP: Duplicate Host header acceptedEPSS 0.3%CVE-2026-48743HIGHEnvoy: HTTP/3 to HTTP/1 request smuggling via headers-only request with nonzero Content-LengthEPSS 0.3%CVE-2026-12606MEDIUMEclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveragEPSS 0.3%CVE-2026-45372CRITICALcpp-httplib: HTTP header value percent-decoding in server-side `parse_header` enables CRLF injectionEPSS 0.3%CVE-2026-100666MEDIUMNetty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodecEPSS 0.3%CVE-2026-79713MEDIUMBreeze Cache 1.2.5 - 2.5.14 - Unauthenticated Cache Poisoning via Unkeyed Tracking ParametersEPSS 0.3%CVE-2026-66338MEDIUMLibsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()EPSS 0.3%CVE-2026-55612LOWuhttpd vulnerable to HTTP request smuggling via invalid chunk-length state resetEPSS 0.3%CVE-2026-64785MEDIUMSwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 bacEPSS 0.3%CVE-2026-16728MEDIUMundici vulnerable to downstream response desynchronization via retry interceptorEPSS 0.3%CVE-2026-6338MEDIUMHTTP request smuggling in Kong Enteprise GatewayEPSS 0.3%CVE-2026-89044MEDIUMNetty 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final HTTP Request Smuggling via Transfer-EncodingEPSS 0.3%