CWE-444
AllowedInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Abstraction: Base · Status: Incomplete
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
674 vulnerabilities reference this CWE, most recent first.
GHSA-666M-W6MW-M583
Vulnerability from github – Published: 2025-03-26 15:32 – Updated: 2025-03-26 15:32IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.
{
"affected": [],
"aliases": [
"CVE-2022-39163"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-26T14:15:20Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Controller 11.0.0 through 11.1.0 is vulnerable to a Client-Side Desync (CSD) attack where an attacker could exploit a desynchronized browser connection that could lead to further cross-site scripting (XSS) attacks.",
"id": "GHSA-666m-w6mw-m583",
"modified": "2025-03-26T15:32:39Z",
"published": "2025-03-26T15:32:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39163"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7192746"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6734-H858-25GR
Vulnerability from github – Published: 2026-09-18 18:31 – Updated: 2026-09-18 18:31IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.
{
"affected": [],
"aliases": [
"CVE-2026-10841"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-18T16:17:05Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling.",
"id": "GHSA-6734-h858-25gr",
"modified": "2026-09-18T18:31:40Z",
"published": "2026-09-18T18:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10841"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7287740"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-67RR-84XM-4C7R
Vulnerability from github – Published: 2025-07-03 21:14 – Updated: 2025-07-03 21:49Summary
A vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.
Under certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page
More details: CVE-2025-49826
Credits
- Allam Rachid zhero;
- Allam Yasser (inzo)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "next"
},
"ranges": [
{
"events": [
{
"introduced": "15.0.4-canary.51"
},
{
"fixed": "15.1.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-49826"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-03T21:14:48Z",
"nvd_published_at": "2025-07-03T21:15:27Z",
"severity": "HIGH"
},
"details": "### Summary\nA vulnerability affecting Next.js has been addressed. It impacted versions 15.0.4 through 15.1.8 and involved a cache poisoning bug leading to a Denial of Service (DoS) condition.\n\nUnder certain conditions, this issue may allow a HTTP 204 response to be cached for static pages, leading to the 204 response being served to all users attempting to access the page\n\nMore details: [CVE-2025-49826](https://vercel.com/changelog/cve-2025-49826)\n\n## Credits\n- Allam Rachid [zhero;](https://zhero-web-sec.github.io/research-and-things/)\n- Allam Yasser (inzo)",
"id": "GHSA-67rr-84xm-4c7r",
"modified": "2025-07-03T21:49:52Z",
"published": "2025-07-03T21:14:48Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/security/advisories/GHSA-67rr-84xm-4c7r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49826"
},
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/commit/16bfce64ef2157f2c1dfedcfdb7771bc63103fd2"
},
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/commit/a15b974ed707d63ad4da5b74c1441f5b7b120e93"
},
{
"type": "PACKAGE",
"url": "https://github.com/vercel/next.js"
},
{
"type": "WEB",
"url": "https://github.com/vercel/next.js/releases/tag/v15.1.8"
},
{
"type": "WEB",
"url": "https://vercel.com/changelog/cve-2025-49826"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Next.JS vulnerability can lead to DoS via cache poisoning "
}
GHSA-67VW-JJGW-XCVQ
Vulnerability from github – Published: 2026-01-26 12:30 – Updated: 2026-01-26 12:30Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection using Content-Length headers. This can cause a desynchronization of requests between frontend and backend servers, which could allow request hiding, cache poisoning or security bypass.
{
"affected": [],
"aliases": [
"CVE-2025-41082"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-26T10:16:05Z",
"severity": "MODERATE"
},
"details": "Illegal HTTP request traffic vulnerability (CL.0) in Altitude Communication Server, caused by inconsistent analysis of multiple HTTP requests over a single Keep-Alive connection using Content-Length headers. This can cause a desynchronization of requests between frontend and backend servers, which could allow request hiding, cache poisoning or security bypass.",
"id": "GHSA-67vw-jjgw-xcvq",
"modified": "2026-01-26T12:30:28Z",
"published": "2026-01-26T12:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-41082"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-altitude-communication-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-68QC-X6C7-F66C
Vulnerability from github – Published: 2022-05-17 00:24 – Updated: 2025-04-20 03:47An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response, so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update, with a Trojan horse executable file (e.g., guardxup.exe) and the correct CRC32 checksum for that file.
{
"affected": [],
"aliases": [
"CVE-2017-15643"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-19T22:29:00Z",
"severity": "HIGH"
},
"details": "An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response, so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update, with a Trojan horse executable file (e.g., guardxup.exe) and the correct CRC32 checksum for that file.",
"id": "GHSA-68qc-x6c7-f66c",
"modified": "2025-04-20T03:47:17Z",
"published": "2022-05-17T00:24:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15643"
},
{
"type": "WEB",
"url": "https://blogs.securiteam.com/index.php/archives/3485"
},
{
"type": "WEB",
"url": "https://www.ikarussecurity.com/about-ikarus/security-blog/vulnerability-in-windows-antivirus-products-ik-sa-2017-0001"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-68QF-XHQ3-9QJ5
Vulnerability from github – Published: 2024-07-26 12:35 – Updated: 2025-11-04 00:30Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.
This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.
Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.
{
"affected": [],
"aliases": [
"CVE-2023-38522"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-444",
"CWE-86"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-26T10:15:01Z",
"severity": "HIGH"
},
"details": "Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerable.\n\nThis issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4.\n\nUsers are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue.",
"id": "GHSA-68qf-xhq3-9qj5",
"modified": "2025-11-04T00:30:58Z",
"published": "2024-07-26T12:35:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-38522"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/c4mcmpblgl8kkmyt56t23543gp8v56m0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00040.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-68X6-P7V3-XXQM
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056.
{
"affected": [],
"aliases": [
"CVE-2021-43610"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-12T22:15:00Z",
"severity": "HIGH"
},
"details": "Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056.",
"id": "GHSA-68x6-p7v3-xxqm",
"modified": "2022-05-24T19:20:28Z",
"published": "2022-05-24T19:20:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43610"
},
{
"type": "WEB",
"url": "https://github.com/BelledonneCommunications/belle-sip/commit/d3f0651531e45e91c2e60f3a16a8b612802e5d2d"
},
{
"type": "WEB",
"url": "https://github.com/BelledonneCommunications/belle-sip/compare/5.0.18...5.0.20"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-68XG-GQQM-VGJ8
Vulnerability from github – Published: 2023-08-18 21:50 – Updated: 2023-08-24 22:34Impact
Prior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.
The following vulnerabilities are addressed by this advisory:
- Incorrect parsing of trailing fields in chunked transfer encoding bodies
- Parsing of blank/zero-length Content-Length headers
Patches
The vulnerability has been fixed in 6.3.1 and 5.6.7.
Workarounds
No known workarounds.
References
For more information
If you have any questions or comments about this advisory:
Open an issue in Puma See our security policy
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "puma"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.6.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "puma"
},
"ranges": [
{
"events": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-40175"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2023-08-18T21:50:05Z",
"nvd_published_at": "2023-08-18T22:15:11Z",
"severity": "CRITICAL"
},
"details": "### Impact\nPrior to version 6.3.1, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling.\n\nThe following vulnerabilities are addressed by this advisory:\n\n* Incorrect parsing of trailing fields in chunked transfer encoding bodies\n* Parsing of blank/zero-length Content-Length headers\n\n### Patches\nThe vulnerability has been fixed in 6.3.1 and 5.6.7.\n\n### Workarounds\nNo known workarounds.\n\n### References\n[HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [Puma](https://github.com/puma/puma)\nSee our [security policy](https://github.com/puma/puma/security/policy)\n",
"id": "GHSA-68xg-gqqm-vgj8",
"modified": "2023-08-24T22:34:11Z",
"published": "2023-08-18T21:50:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/puma/puma/security/advisories/GHSA-68xg-gqqm-vgj8"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40175"
},
{
"type": "WEB",
"url": "https://github.com/puma/puma/commit/690155e7d644b80eeef0a6094f9826ee41f1080a"
},
{
"type": "WEB",
"url": "https://github.com/puma/puma/commit/7405a219801dcebc0ad6e0aa108d4319ca23f662"
},
{
"type": "WEB",
"url": "https://github.com/puma/puma/commit/ed0f2f94b56982c687452504b95d5f1fbbe3eed1"
},
{
"type": "PACKAGE",
"url": "https://github.com/puma/puma"
},
{
"type": "WEB",
"url": "https://github.com/puma/puma/releases/tag/v5.6.7"
},
{
"type": "WEB",
"url": "https://github.com/puma/puma/releases/tag/v6.3.1"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2023-40175.yml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Puma HTTP Request/Response Smuggling vulnerability"
}
GHSA-694P-XRHG-X3WM
Vulnerability from github – Published: 2020-03-30 20:54 – Updated: 2023-11-06 11:08Vulnerability
Micronaut's HTTP client is vulnerable to "HTTP Request Header Injection" due to not validating request headers passed to the client.
Example of vulnerable code:
@Controller("/hello")
public class HelloController {
@Inject
@Client("/")
RxHttpClient client;
@Get("/external-exploit")
@Produces(MediaType.TEXT_PLAIN)
public String externalExploit(@QueryValue("header-value") String headerValue) {
return client.toBlocking().retrieve(
HttpRequest.GET("/hello")
.header("Test", headerValue)
);
}
}
In the above case a query value received from a user is passed as a header value to the client. Since the client doesn't validate the header value the request headers and body have the potential to be manipulated.
For example, a user that supplies the following payload, can force the client to make multiple attacker-controlled HTTP requests.
List<String> headerData = List.of(
"Connection: Keep-Alive", // This keeps the connection open so another request can be stuffed in.
"",
"",
"POST /hello/super-secret HTTP/1.1",
"Host: 127.0.0.1",
"Content-Length: 31",
"",
"{\"new\":\"json\",\"content\":\"here\"}",
"",
""
);
String headerValue = "H\r\n" + String.join("\r\n", headerData);;
URI theURI =
UriBuilder
.of("/hello/external-exploit")
.queryParam("header-value", headerValue) // Automatically URL encodes data
.build();
HttpRequest<String> request = HttpRequest.GET(theURI);
String body = client.toBlocking().retrieve(request);
Note that using @HeaderValue instead of @QueryValue is not vulnerable since Micronaut's HTTP server does validate the headers passed to the server, so the exploit can only be triggered by using user data that is not an HTTP header (query values, form data etc.).
Impact
The attacker is able to control the entirety of the HTTP body for their custom requests. As such, this vulnerability enables attackers to perform a variant of Server Side Request Forgery.
Patches
The problem has been patched in the micronaut-http-client versions 1.2.11 and 1.3.2 and above.
Workarounds
Do not pass user data directly received from HTTP request parameters as headers in the HTTP client.
References
Fix commits - https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1 - https://github.com/micronaut-projects/micronaut-core/commit/6deb60b75517f80c57b42d935f07955c773b766d - https://github.com/micronaut-projects/micronaut-core/commit/bc855e439c4a5ced3d83195bb59d0679cbd95add
For more information
If you have any questions or comments about this advisory:
- Open an issue in micronaut-core
- Email us at info@micronaut.io
Credit
Originally reported by @JLLeitschuh
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.micronaut:micronaut-http-client"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.micronaut:micronaut-http-client"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0"
},
{
"fixed": "1.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-7611"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": true,
"github_reviewed_at": "2020-03-30T20:54:42Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Vulnerability\n\nMicronaut\u0027s HTTP client is vulnerable to \"HTTP Request Header Injection\" due to not validating request headers passed to the client.\n\nExample of vulnerable code:\n\n```java\n@Controller(\"/hello\")\npublic class HelloController {\n\n @Inject\n @Client(\"/\")\n RxHttpClient client;\n\n @Get(\"/external-exploit\")\n @Produces(MediaType.TEXT_PLAIN)\n public String externalExploit(@QueryValue(\"header-value\") String headerValue) {\n return client.toBlocking().retrieve(\n HttpRequest.GET(\"/hello\")\n .header(\"Test\", headerValue)\n );\n }\n}\n```\n\nIn the above case a query value received from a user is passed as a header value to the client. Since the client doesn\u0027t validate the header value the request headers and body have the potential to be manipulated.\n\nFor example, a user that supplies the following payload, can force the client to make multiple attacker-controlled HTTP requests.\n\n```java\nList\u003cString\u003e headerData = List.of(\n \"Connection: Keep-Alive\", // This keeps the connection open so another request can be stuffed in.\n \"\",\n \"\",\n \"POST /hello/super-secret HTTP/1.1\",\n \"Host: 127.0.0.1\",\n \"Content-Length: 31\",\n \"\",\n \"{\\\"new\\\":\\\"json\\\",\\\"content\\\":\\\"here\\\"}\",\n \"\",\n \"\"\n);\nString headerValue = \"H\\r\\n\" + String.join(\"\\r\\n\", headerData);;\nURI theURI =\n UriBuilder\n .of(\"/hello/external-exploit\")\n .queryParam(\"header-value\", headerValue) // Automatically URL encodes data\n .build();\nHttpRequest\u003cString\u003e request = HttpRequest.GET(theURI);\nString body = client.toBlocking().retrieve(request);\n```\n\nNote that using `@HeaderValue` instead of `@QueryValue` is not vulnerable since Micronaut\u0027s HTTP server does validate the headers passed to the server, so the exploit can only be triggered by using user data that is not an HTTP header (query values, form data etc.).\n\n### Impact\n\nThe attacker is able to control the entirety of the HTTP body for their custom requests.\nAs such, this vulnerability enables attackers to perform a variant of [Server Side Request Forgery](https://cwe.mitre.org/data/definitions/918.html).\n\n### Patches\n\nThe problem has been patched in the `micronaut-http-client` versions 1.2.11 and 1.3.2 and above.\n\n### Workarounds\n\nDo not pass user data directly received from HTTP request parameters as headers in the HTTP client.\n\n### References\n\nFix commits\n- https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1\n- https://github.com/micronaut-projects/micronaut-core/commit/6deb60b75517f80c57b42d935f07955c773b766d\n- https://github.com/micronaut-projects/micronaut-core/commit/bc855e439c4a5ced3d83195bb59d0679cbd95add\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [micronaut-core](https://github.com/micronaut-projects/micronaut-core)\n* Email us at [info@micronaut.io](mailto:info@micronaut.io)\n\n### Credit\n\nOriginally reported by @JLLeitschuh \n",
"id": "GHSA-694p-xrhg-x3wm",
"modified": "2023-11-06T11:08:02Z",
"published": "2020-03-30T20:54:55Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/security/advisories/GHSA-694p-xrhg-x3wm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7611"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/commit/6deb60b75517f80c57b42d935f07955c773b766d"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/commit/9d1eff5c8df1d6cda1fe00ef046729b2a6abe7f1"
},
{
"type": "WEB",
"url": "https://github.com/micronaut-projects/micronaut-core/commit/bc855e439c4a5ced3d83195bb59d0679cbd95add"
},
{
"type": "PACKAGE",
"url": "https://github.com/micronaut-projects/micronaut-core"
},
{
"type": "WEB",
"url": "https://snyk.io/vuln/SNYK-JAVA-IOMICRONAUT-561342"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Micronaut\u0027s HTTP client is vulnerable to HTTP Request Header Injection"
}
GHSA-694Q-MQC8-23W4
Vulnerability from github – Published: 2022-05-14 02:41 – Updated: 2022-05-14 02:41HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.
{
"affected": [],
"aliases": [
"CVE-2018-7068"
],
"database_specific": {
"cwe_ids": [
"CWE-444"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-08-06T20:29:00Z",
"severity": "MODERATE"
},
"details": "HPE has identified a remote HOST header attack vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is resolved in HF16 for HPE CV 6.1 or subsequent version.",
"id": "GHSA-694q-mqc8-23w4",
"modified": "2022-05-14T02:41:32Z",
"published": "2022-05-14T02:41:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7068"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbmu03837en_us"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
Mitigation
Use only SSL communication.
Mitigation
Terminate the client session after each request.
Mitigation
Turn all pages to non-cacheable.
CAPEC-273: HTTP Response Smuggling
An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).
See CanPrecede relationships for possible consequences.
CAPEC-33: HTTP Request Smuggling
An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).
See CanPrecede relationships for possible consequences.