Description
HTTP request smuggling vulnerability in Pound before 1.9.4 allows remote attackers to poison web caches, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with conflicting Content-length and Transfer-encoding headers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pound | 1.9.4-1 | — |
| Debian 13 | pound | 1.9.4-1 | — |
| Debian 3.1 | pound | 1.8.2-1sarge1 | DSA-934-1 |
Advisories 1
- DSA-934-1 pound - remote Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-934 vendor-advisory
- 18367 third-party-advisory
- SUSE-SR:2006:011 vendor-advisory
- [pound-list] 20051020 ANNOUNCE: Pound - reverse proxy and load balancer - v1.9.4 mailing-list
- GLSA-200606-05 vendor-advisory
- 20215 third-party-advisory
- 18381 third-party-advisory
- 20510 third-party-advisory