Common Weakness Enumeration

CWE-444

Allowed

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.

694 vulnerabilities reference this CWE, most recent first.

GHSA-8M85-WQG7-C529

Vulnerability from github – Published: 2026-07-14 03:31 – Updated: 2026-09-01 21:20
VLAI
Summary
SAP Approuter Vulnerable to HTTP Request Smuggling
Details

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@sap/approuter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "20.10.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27690"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-01T21:20:31Z",
    "nvd_published_at": "2026-07-14T01:16:17Z",
    "severity": "CRITICAL"
  },
  "details": "Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability.",
  "id": "GHSA-8m85-wqg7-c529",
  "modified": "2026-09-01T21:20:31Z",
  "published": "2026-07-14T03:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27690"
    },
    {
      "type": "WEB",
      "url": "https://me.sap.com/notes/3720138"
    },
    {
      "type": "WEB",
      "url": "https://url.sap/sapsecuritypatchday"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SAP Approuter Vulnerable to HTTP Request Smuggling"
}

GHSA-8P2Q-73GC-FXQ5

Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details

Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox < 91.0.1 and Thunderbird < 91.0.1.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-29991"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-03T01:15:00Z",
    "severity": "HIGH"
  },
  "details": "Firefox incorrectly accepted a newline in a HTTP/3 header, interpretting it as two separate headers. This allowed for a header splitting attack against servers using HTTP/3. This vulnerability affects Firefox \u003c 91.0.1 and Thunderbird \u003c 91.0.1.",
  "id": "GHSA-8p2q-73gc-fxq5",
  "modified": "2022-05-24T19:19:37Z",
  "published": "2022-05-24T19:19:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29991"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1724896"
    },
    {
      "type": "WEB",
      "url": "https://www.mozilla.org/security/advisories/mfsa2021-37"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8PXM-658R-R9J2

Vulnerability from github – Published: 2024-03-20 15:32 – Updated: 2024-08-05 21:31
VLAI
Details

An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-22081"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444",
      "CWE-644"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-20T05:15:45Z",
    "severity": "CRITICAL"
  },
  "details": "An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. Unauthenticated memory corruption can occur in the HTTP header parsing mechanism.",
  "id": "GHSA-8pxm-658r-r9j2",
  "modified": "2024-08-05T21:31:18Z",
  "published": "2024-03-20T15:32:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22081"
    },
    {
      "type": "WEB",
      "url": "https://www.elspec-ltd.com/support/security-advisories"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8QPW-XQXJ-H4R2

Vulnerability from github – Published: 2024-01-29 22:30 – Updated: 2025-11-03 22:35
VLAI
Summary
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
Details

Summary

Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.

Details

These problems are rooted in pattern matching protocol elements, previously improved by PR #3235 and GHSA-gfw2-4jvh-wgfg:

  1. The expression HTTP/(\d).(\d) lacked another backslash to clarify that the separator should be a literal dot, not just any Unicode code point (result: HTTP/(\d)\.(\d)).

  2. The HTTP version was permitting Unicode digits, where only ASCII digits are standards-compliant.

  3. Distinct regular expressions for validating HTTP Method and Header field names were used - though both should (at least) apply the common restrictions of rfc9110 token.

PoC

GET / HTTP/1ö1 GET / HTTP/1.𝟙 GET/: HTTP/1.1 Content-Encoding?: chunked

Impact

Primarily concerns running an aiohttp server without llhttp: 1. behind a proxy: Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling. 2. directly accessible or exposed behind proxies relaying malformed input: the unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities.

Patch: https://github.com/aio-libs/aiohttp/pull/8074/files

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "aiohttp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-23829"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-01-29T22:30:07Z",
    "nvd_published_at": "2024-01-29T23:15:08Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nSecurity-sensitive parts of the *Python HTTP parser* retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of proxies in order to protect against injection of additional requests. Additionally, validation could trigger exceptions that were not handled consistently with processing of other malformed input.\n\n### Details\nThese problems are rooted in pattern matching protocol elements, previously improved by PR #3235 and GHSA-gfw2-4jvh-wgfg:\n\n1. The expression `HTTP/(\\d).(\\d)` lacked another backslash to clarify that the separator should be a literal dot, not just *any* Unicode code point (result: `HTTP/(\\d)\\.(\\d)`).\n\n2. The HTTP version was permitting Unicode digits, where only ASCII digits are standards-compliant.\n\n3. Distinct regular expressions for validating HTTP Method and Header field names were used - though both should (at least) apply the common restrictions of rfc9110 `token`.\n\n### PoC\n`GET / HTTP/1\u00f61`\n`GET / HTTP/1.\ud835\udfd9`\n`GET/: HTTP/1.1`\n`Content-Encoding?: chunked`\n\n### Impact\nPrimarily concerns running an aiohttp server without llhttp:\n 1. **behind a proxy**: Being more lenient than internet standards require could, depending on deployment environment, assist in request smuggling.\n 2. **directly accessible** or exposed behind proxies relaying malformed input: the unhandled exception could cause excessive resource consumption on the application server and/or its logging facilities.\n\n-----\n\nPatch: https://github.com/aio-libs/aiohttp/pull/8074/files",
  "id": "GHSA-8qpw-xqxj-h4r2",
  "modified": "2025-11-03T22:35:14Z",
  "published": "2024-01-29T22:30:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23829"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/pull/3235"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/pull/8074"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/pull/8074/files"
    },
    {
      "type": "WEB",
      "url": "https://github.com/aio-libs/aiohttp/commit/33ccdfb0a12690af5bb49bda2319ec0907fa7827"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/aio-libs/aiohttp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp/PYSEC-2024-26.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ICUOCFGTB25WUT336BZ4UNYLSZOUVKBD"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXWVZIVAYWEBHNRIILZVB3R3SDQNNAA7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "aiohttp\u0027s HTTP parser (the python one, not llhttp) still overly lenient about separators"
}

GHSA-8QQM-FP2Q-V734

Vulnerability from github – Published: 2026-07-17 21:49 – Updated: 2026-09-25 17:03
VLAI
Summary
Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies
Details

Summary

A wrong policy can be an open door. You have to check input.attributes.request.http.truncated_body in your policy.

Description

Incomplete fix for CVE-2026-50197: an oversized declared-Content-Length body still hands OPA an empty parsed_body, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream.

The CVE-2026-50197 fix (commit 3152f3b0, PR #4041, v0.26.10) substituted expectedSize = maxBodyBytes only when req.ContentLength < 0 (chunked / HTTP/2 without content-length). But when a request declares a Content-Length larger than maxBodyBytes, expectedSize > maxBodyBytes, the body-extraction if is skipped entirely, and ExtractHttpBodyOptionally returns rawBodyBytes = nil — so OPA evaluates an empty parsed_body, while the full forbidden payload still flows to the upstream. A deny-on-presence policy (default allow = true; allow = false if input.parsed_body.<forbidden>) — the exact Rego shape the advisory describes — fails OPEN. The fix's own comment reasons only about ContentLength == -1; the oversized branch was never considered, and the added PoC test only covers small bodies.

Affected code

  • filters/openpolicyagent/openpolicyagent.go ExtractHttpBodyOptionally: the expectedSize <= maxBodyBytes gate lets an oversized declared body fall through to return req.Body, nil, func() {}, nil (OPA sees an empty document).
  • Corroborated by Skipper's own unit test "Read body exhausting max bytes" ({ "welcome": "world" }, maxBodySize: 5 → bodyInPolicy: "").

Steps to reproduce

See attached docker-compose.yml (official golang image) + setup.sh + exploit.sh, which run a real Skipper proxy (proxytest) with a real OPA control plane (opasdktest), WithMaxRequestBodyBytes(32), policy allow = false if input.parsed_body.action == "delete", route * -> opaAuthorizeRequestWithBody("test") -> upstream: - {"action":"delete"} (19B ≤ 32) → 403 (denied). - {"action":"delete","pad":"X..64"} (> 32) → 200, upstream received the full body (BYPASS). - small chunked {"action":"delete"} → 403 (positive control: the original CVE is fixed).

(Library-tier: validated via Skipper's real proxy test harness, not a deploy of the official image; benign oracle = status diff + upstream-received body; no RCE.)

Impact

Deployments authorizing on request-body content via opaAuthorizeRequestWithBody + deny-on-presence Rego can be bypassed by inflating the request body past -open-policy-agent-max-request-body-size (default 1 MB); the full payload still reaches the upstream.

Mitigation

Document how policy owners should block requests with oversized body.

Example deny by default and use "allow if" no oversized body:

default allow := false

allow if {
    input.attributes.request.http.truncated_body == false
    # ... body-based conditions
}

Example allow by default and use "deny if" an oversized body:

default deny := false

deny if {
    input.attributes.request.http.truncated_body == true
    # ... body-based conditions
}

Documentation is published by https://github.com/zalando/skipper/releases/tag/v0.27.26

Credit

Reported as part of an incomplete-patch measurement study (responsible disclosure).

Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zalando/skipper"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.27.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-65838"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-17T21:49:48Z",
    "nvd_published_at": "2026-09-14T20:16:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA wrong policy can be an open door. \nYou have to check `input.attributes.request.http.truncated_body` in your policy.\n\n### Description\n\nIncomplete fix for CVE-2026-50197: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream.\n\nThe CVE-2026-50197 fix (commit `3152f3b0`, PR #4041, v0.26.10) substituted `expectedSize = maxBodyBytes`\nonly when `req.ContentLength \u003c 0` (chunked / HTTP/2 without content-length). But when a request declares a\n`Content-Length` larger than `maxBodyBytes`, `expectedSize \u003e maxBodyBytes`, the body-extraction `if` is\nskipped entirely, and `ExtractHttpBodyOptionally` returns `rawBodyBytes = nil` \u2014 so OPA evaluates an empty\n`parsed_body`, while the full forbidden payload still flows to the upstream. A deny-on-presence policy\n(`default allow = true; allow = false if input.parsed_body.\u003cforbidden\u003e`) \u2014 the exact Rego shape the\nadvisory describes \u2014 fails OPEN. The fix\u0027s own comment reasons only about `ContentLength == -1`; the\noversized branch was never considered, and the added PoC test only covers small bodies.\n\n### Affected code\n\n- `filters/openpolicyagent/openpolicyagent.go` `ExtractHttpBodyOptionally`: the\n  `expectedSize \u003c= maxBodyBytes` gate lets an oversized declared body fall through to\n  `return req.Body, nil, func() {}, nil` (OPA sees an empty document).\n- Corroborated by Skipper\u0027s own unit test \"Read body exhausting max bytes\" (`{ \"welcome\": \"world\" }`,\n  `maxBodySize: 5` \u2192 `bodyInPolicy: \"\"`).\n\n### Steps to reproduce\n\nSee attached `docker-compose.yml` (official `golang` image) + `setup.sh` + `exploit.sh`, which run a real\nSkipper proxy (`proxytest`) with a real OPA control plane (`opasdktest`),\n`WithMaxRequestBodyBytes(32)`, policy `allow = false if input.parsed_body.action == \"delete\"`, route\n`* -\u003e opaAuthorizeRequestWithBody(\"test\") -\u003e upstream`:\n- `{\"action\":\"delete\"}` (19B \u2264 32) \u2192 **403** (denied).\n- `{\"action\":\"delete\",\"pad\":\"X..64\"}` (\u003e 32) \u2192 **200**, upstream received the full body (BYPASS).\n- small chunked `{\"action\":\"delete\"}` \u2192 **403** (positive control: the original CVE is fixed).\n\n(Library-tier: validated via Skipper\u0027s real proxy test harness, not a deploy of the official image; benign\noracle = status diff + upstream-received body; no RCE.)\n\n### Impact\n\nDeployments authorizing on request-body content via `opaAuthorizeRequestWithBody` + deny-on-presence Rego\ncan be bypassed by inflating the request body past `-open-policy-agent-max-request-body-size` (default\n1 MB); the full payload still reaches the upstream.\n\n### Mitigation\n\nDocument how policy owners should block requests with oversized body.\n\nExample deny by default and use \"allow if\" no oversized body:\n```rego\ndefault allow := false\n\nallow if {\n    input.attributes.request.http.truncated_body == false\n    # ... body-based conditions\n}\n```\n\nExample allow by default and use \"deny if\" an oversized body:\n```rego\ndefault deny := false\n\ndeny if {\n    input.attributes.request.http.truncated_body == true\n    # ... body-based conditions\n}\n```\n\nDocumentation is published by https://github.com/zalando/skipper/releases/tag/v0.27.26\n\n### Credit\n\nReported as part of an incomplete-patch measurement study (responsible disclosure).",
  "id": "GHSA-8qqm-fp2q-v734",
  "modified": "2026-09-25T17:03:31Z",
  "published": "2026-07-17T21:49:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/security/advisories/GHSA-8qqm-fp2q-v734"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65838"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/commit/2cfceabaa6ff0af65b312dcb9bcbe84691b9d507"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zalando/skipper"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.27.26"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zalando/skipper/releases/tag/v0.27.35"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies"
}

GHSA-8V4X-MGVP-P658

Vulnerability from github – Published: 2026-03-27 18:31 – Updated: 2026-06-11 00:32
VLAI
Summary
Undertow is Vulnerable to HTTP Request/Response Smuggling
Details

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.

Severity
8.7 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.undertow:undertow-parent"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2.3.23.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-28368"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-31T23:14:15Z",
    "nvd_published_at": "2026-03-27T17:16:27Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources.",
  "id": "GHSA-8v4x-mgvp-p658",
  "modified": "2026-06-11T00:32:03Z",
  "published": "2026-03-27T18:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28368"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:25125"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:25126"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-28368"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2443261"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/undertow-io/undertow"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Undertow is Vulnerable to HTTP Request/Response Smuggling"
}

GHSA-8VHQ-594P-R648

Vulnerability from github – Published: 2022-05-14 01:04 – Updated: 2022-05-14 01:04
VLAI
Details

The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.

Severity
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-5740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-10-18T20:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a request with two Content-length headers.",
  "id": "GHSA-8vhq-594p-r648",
  "modified": "2022-05-14T01:04:30Z",
  "published": "2022-05-14T01:04:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/golang/go/commit/300d9a21583e7cf0149a778a0611e76ff7c6680f"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1250352"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/167997.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168029.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2016-1538.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/oss-sec/2015/q3/237"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/oss-sec/2015/q3/292"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/oss-sec/2015/q3/294"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8VMP-V4PM-X3HQ

Vulnerability from github – Published: 2026-09-10 18:31 – Updated: 2026-09-14 21:31
VLAI
Details

An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-68006"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T18:18:04Z",
    "severity": "CRITICAL"
  },
  "details": "An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file",
  "id": "GHSA-8vmp-v4pm-x3hq",
  "modified": "2026-09-14T21:31:25Z",
  "published": "2026-09-10T18:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68006"
    },
    {
      "type": "WEB",
      "url": "https://github.com/czx1111/cve/issues/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8VP7-J5CJ-VVM2

Vulnerability from github – Published: 2020-01-31 18:00 – Updated: 2024-02-07 18:42
VLAI
Summary
Ability to expose data in Sylius by using an unintended serialisation group
Details

Impact

ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.

Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2.

Patches

The patch is provided for ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

After it is applied, It allows to choose only the groups that are defined in serialization_groups or allowed_serialization_groups route definition. Any group not defined in those will not be used.

This behaviour might be a BC break for those using custom groups via the HTTP header, please adjust allowed_serialization_groups accordingly.

Workarounds

Service sylius.resource_controller.request_configuration_factory can be overridden with an implementation copied from \Sylius\Bundle\ResourceBundle\Controller\RequestConfigurationFactory where the part that handles custom serialisation groups is deleted.

Severity
4.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/resource-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/resource-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/resource-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.6.0"
            },
            {
              "fixed": "1.6.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.4.0"
            },
            {
              "fixed": "1.4.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/resource-bundle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.3.13"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-5220"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-444"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-01-27T20:11:32Z",
    "nvd_published_at": "2020-01-27T21:15:11Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.\n\nAnyone exposing an API with ResourceBundle\u0027s controller is affected. The vulnerable versions are: `\u003c1.3 || \u003e=1.3.0 \u003c=1.3.12 || \u003e=1.4.0 \u003c=1.4.5 || \u003e=1.5.0 \u003c=1.5.0 || \u003e=1.6.0 \u003c=1.6.2`.\n\n### Patches\n\nThe patch is provided for ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.\n\nAfter it is applied, It allows to choose only the groups that are defined in `serialization_groups` or `allowed_serialization_groups` route definition. Any group not defined in those will not be used.\n\nThis behaviour might be a BC break for those using custom groups via the HTTP header, please adjust `allowed_serialization_groups` accordingly.\n\n### Workarounds\n\nService `sylius.resource_controller.request_configuration_factory` can be overridden with an implementation copied from `\\Sylius\\Bundle\\ResourceBundle\\Controller\\RequestConfigurationFactory` where the part that handles custom serialisation groups is deleted.",
  "id": "GHSA-8vp7-j5cj-vvm2",
  "modified": "2024-02-07T18:42:55Z",
  "published": "2020-01-31T18:00:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5220"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2020-5220.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ability to expose data in Sylius by using an unintended serialisation group"
}

GHSA-8VXJ-GX32-J925

Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-05-24 19:07
VLAI
Details

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-36740"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-444"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-14T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.",
  "id": "GHSA-8vxj-gx32-j925",
  "modified": "2022-05-24T19:07:57Z",
  "published": "2022-05-24T19:07:57Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36740"
    },
    {
      "type": "WEB",
      "url": "https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be"
    },
    {
      "type": "WEB",
      "url": "https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf"
    },
    {
      "type": "WEB",
      "url": "https://docs.varnish-software.com/security/VSV00007"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK"
    },
    {
      "type": "WEB",
      "url": "https://varnish-cache.org/security/VSV00007.html"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2022/dsa-5088"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Implementation

Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].

Mitigation
Implementation

Use only SSL communication.

Mitigation
Implementation

Terminate the client session after each request.

Mitigation
System Configuration

Turn all pages to non-cacheable.

CAPEC-273: HTTP Response Smuggling

An adversary manipulates and injects malicious content in the form of secret unauthorized HTTP responses, into a single HTTP response from a vulnerable or compromised back-end HTTP agent (e.g., server).

See CanPrecede relationships for possible consequences.

CAPEC-33: HTTP Request Smuggling

An adversary abuses the flexibility and discrepancies in the parsing and interpretation of HTTP Request messages using various HTTP headers, request-line and body parameters as well as message sizes (denoted by the end of message signaled by a given HTTP header) by different intermediary HTTP agents (e.g., load balancer, reverse proxy, web caching proxies, application firewalls, etc.) to secretly send unauthorized and malicious HTTP requests to a back-end HTTP agent (e.g., web server).

See CanPrecede relationships for possible consequences.

← Back to the CWE list