What is the CVSS score of CVE-2024-10264?

CVE-2024-10264 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Qanything are affected by CVE-2024-10264?

Organizations using netease-youdao/qanything face critical risk from CVE-2024-10264 rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2024-10264?

Yes, a public proof-of-concept exploit is available for CVE-2024-10264. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2024-10264?

Within 24 hours: Identify all affected systems running netease-youdao/qanything and apply vendor patches immediately. Monitor vendor channels for patch availability.

Qanything CVE-2024-10264

CRITICAL

HTTP Request/Response Smuggling (CWE-444)

2025-03-20 security@huntr.dev

Request Smuggling RCE Authentication Bypass Qanything

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:32 vuln.today

PoC Detected

Aug 01, 2025 - 10:51 vuln.today

Public exploit code

CVE Published

Mar 20, 2025 - 10:15 nvd

CRITICAL 9.8

DescriptionCVE.org

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution.

AnalysisAI

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as HTTP Request/Response Smuggling (CWE-444), which allows attackers to manipulate HTTP request interpretation between frontend and backend servers. HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and potentially arbitrary code execution. Affected products include: Youdao Qanything. Version information: version 1.4.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Enforce strict HTTP parsing, normalize requests at proxy layer, use HTTP/2 end-to-end, reject ambiguous headers.