Weakness (CWE)
CWE-444: Inconsistent Interpretation of HTTP Requests
The product acts as an intermediary HTTP agent
(such as a proxy or firewall) in the data flow between two
entities such as a client and server, but it does not
interpret malformed HTTP requests or responses in ways that
are consistent with how the messages will be processed by
those entities that are at the ultimate destination.
More detail
HTTP requests or responses ("messages") can be
malformed or unexpected in ways that cause web servers or
clients to interpret the messages in different ways than
intermediary HTTP agents such as load balancers, reverse
proxies, web caching proxies, application firewalls,
etc. For example, an adversary may be able to add duplicate
or different header fields that a client or server might
interpret as one set of messages, whereas the intermediary
might interpret the same sequence of bytes as a different
set of messages. For example, discrepancies can arise in
how to handle duplicate headers like two Transfer-encoding
(TE) or two Content-length (CL), or the malicious HTTP
message will have different headers for TE and
CL.
The inconsistent parsing and interpretation of messages
can allow the adversary to "smuggle" a message to the
client/server without the intermediary being aware of it.
This weakness is usually the result of the usage
of outdated or incompatible HTTP protocol versions in the
HTTP agents.
How to prevent it (4 mitigations)
-
Implementation
Use a web server that employs a strict HTTP parsing procedure, such as Apache [REF-433].
-
Implementation
Use only SSL communication.
-
Implementation
Terminate the client session after each request.
-
System Configuration
Turn all pages to non-cacheable.
Source: MITRE CWE-444
406 results · Feed
-
Medium 6.5
aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Security-sensitive parts of the Python HTTP parser retained minor differences in allowable character sets, that must trigger error handling to robustly match frame boundaries of p…
-
High 7.5
chasquid HTTP Request/Response Smuggling vulnerability
chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.
-
Medium 5.3
@fastify-reply-from JSON Content-Type parsing confusion
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an header `ContentType: application/json ; charset=utf-8`. Th…
-
Medium 5.9
HTTP Request/Response Smuggling in puma
Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chun…
-
Medium 4.3
Client-Side Desynchronization vulnerability in SAP Fiori Launchpad
SAP Fiori launchpad - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, SAP_UI 758, UI_700 200, SAP_BASIS 793, allows an attacker to use HTTP verb POST on read-only service causing low impact on Confidentiality of the application.
-
High 7.5
Apache Tomcat: HTTP request smuggling via malformed trailer headers
Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that e…
-
Medium —
aiohttp has vulnerable dependency that is vulnerable to request smuggling
### Summary llhttp 8.1.1 is vulnerable to two request smuggling vulnerabilities. Details have not been disclosed yet, so refer to llhttp for future information. The issue is resolved by using llhttp 9+ (which is included in aiohttp 3.8.6+).
-
Critical 9.6
Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683…
KEV Jan 13, 2025 -
Medium 5.0
Generic Extractor MITM Vulnerability in yt-dlp
yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP sessio…
-
Medium 5.3
Request smuggling in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which could lead to request smuggling. This parser is only used when AIOHTTP_NO_EXTENSIONS is enabled (or not…
-
Low 3.4
Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttp
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Lengt…
-
Critical 9.3
Squid: request/response smuggling in http/1.1 and icap
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.
-
Medium 5.3
twisted.web has disordered HTTP pipeline response
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endp…
-
Medium 5.4
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP …
-
Critical 9.6
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and ea…
KEV Dec 7, 2023 -
High 7.3
Inconsistent Interpretation of HTTP Requests in puma
Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Sever…
-
Critical 9.1
Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
-
Medium 5.8
protocol-http1 HTTP Request/Response Smuggling vulnerability
protocol-http1 provides a low-level implementation of the HTTP/1 protocol. RFC 9112 Section 7.1 defined the format of chunk size, chunk data and chunk extension. The value of Content-Length header should be a string of 0-9 digits, the chunk size should be a s…
-
Medium 5.3
aiohttp vulnerable to HTTP request smuggling
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. aiohttp v3.8.4 and earlier are bundled with llhttp v6.0.6. Vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing …
-
High 8.6
Request smuggling and request concatenation in SAP Web Dispatcher
An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7…
-
Critical 9.1CVE-2023-33193 Scanner template
Emby Server Proxy Header Spoofing Vulnerability
Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them available for viewing at home and abroad on a broad range of client devices. This vulnerability may allow administrative…
-
Critical 9.8
SwiftNIO vulnerable to HTTP request smuggling using malformed Transfer-Encoding header
### Impact Affected SwiftNIO systems are vulnerable to request smuggling attacks, in which they parse a given HTTP message differently from other network parties, potentially seeing a different number of requests than other servers. This can lead to failures …
-
Critical 9.8
LavaLite vulnerable to web cache poisoning
LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
-
High 7.3CVE-2023-25950 Public exploit
HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to …
-
Critical 9.8
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header.
-
High 7.5
Apache HTTP Server: mod_proxy_uwsgi HTTP response splitting
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
-
Critical 9.8
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…
-
Critical 9.1CVE-2023-25725 Public exploit
HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in some situati…
-
High 8.1
Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated …
-
Critical 9.0
Apache HTTP Server: mod_proxy_ajp Possible request smuggling
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Se…
-
High 7.5
Request smuggling due to improper request handling in golang.org/x/net/http2/h2c
A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTT…
-
Medium 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…
-
Medium 6.1
Client-Side Desync Vulnerability
This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.
-
High 7.5CVE-2022-45059 Public exploit
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be per…
-
High 7.5
Apache Tomcat request smuggling via malformed content-length
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing a…
-
Unscored —CVE-2022-21826 EPSS 46%
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application rec…
-
Critical 9.8CVE-2022-2466 Public exploit
Quarkus does not terminate HTTP requests header context
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
-
Medium 4.3
A vulnerability in the VPN web client services component of Cisco Adaptive Security Appliance (ASA) Software and Cisco …
-
Medium 6.8
Improper input validation on HTTP/2 headers
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
-
High 7.2
HTTP Host Header Attack Vulnerability in laminas-diactoros
laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications that use Diactoros, and are either not behind a proxy, or can be accessed via untrusted proxies, can po…