CVE-2025-1867
CRITICALVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V4 - API and Web Service HTTP request consistency
|
| Impact | Maximum severity with CVSS 10.0 (4.0 scoring). Attack is network-accessible with low complexity, no authentication required, no user interaction needed. Impact extends to downstream components (scope changed). No known active exploitation or public PoC at time of analysis, but HTTP smuggling techniques are well-documented and tooling is widely available (e.g., smuggler.py, HTTP Request Smuggler Burp extension). |
| Exploit ScenarioDerived | An attacker sends a crafted HTTP request to a web application fronted by a reverse proxy (e.g., nginx) with libhv as the backend server. The proxy interprets the request as one complete request, but libhv parses it as two separate requests due to inconsistent header handling. The second smuggled request can hijack the next legitimate users session, bypass WAF rules, access restricted endpoints, or poison the cache to serve malicious content to all subsequent visitors. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
A critical HTTP Request/Response Smuggling vulnerability (CWE-444) in ithewei libhv library versions up to 1.3.3 allows attackers to manipulate HTTP request interpretation between frontend and backend servers. With a CVSS 4.0 score of 10.0, this vulnerability requires no authentication or user interaction and can be exploited remotely with low complexity. HTTP smuggling attacks can bypass security controls, poison web caches, hijack user sessions, and enable cross-site scripting, making this particularly dangerous in environments using libhv as a reverse proxy or HTTP server component.
Earlier versions of this analysis (1)
A critical HTTP Request/Response Smuggling vulnerability in ithewei libhv through version 1.3.3 enables remote attackers to exploit inconsistent HTTP request parsing between frontend and backend components. CVSS 4.0 rates this at maximum severity (10.0) with network attack vector, no privileges required, and high impact across all CIA dimensions including downstream systems.
RemediationAI
Upgrade libhv to a version newer than 1.3.3 once a patch is released. As a workaround, ensure strict HTTP parsing is enforced on any reverse proxy in front of libhv (e.g., nginx proxy_request_buffering on, reject ambiguous Transfer-Encoding headers). Monitor for unusual HTTP request patterns that may indicate smuggling attempts. Consider implementing HTTP/2 end-to-end which is not susceptible to classic smuggling attacks.
Affected ProductsAI
ithewei libhv versions up to and including 1.3.3. Applications embedding libhv as HTTP server or proxy component are affected. Common deployment contexts include IoT devices, embedded Linux systems, and lightweight C++ web services.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libhv is a cross-platform C/C++ network library providing HTTP client/server, WebSocket, and event loop functionality. HTTP Request Smuggling (CWE-444) occurs when front-end and back-end servers interpret HTTP request boundaries differently, typically through ambiguous Content-Length and Transfer-Encoding headers. The libhv library is used in embedded systems, IoT devices, and as a lightweight HTTP server in C++ applications. The vulnerability likely stems from non-compliant HTTP/1.1 parsing that allows crafted requests to be split or merged differently by chained HTTP processors.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in ithewei libhv allows HTTP Response Smuggling.This issue affects libhv: through 1.3.3.
Executive ViewAI
CVE-2025-1867 presents critical security risk rated CVSS 10.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
HTTP request smuggling exploits inconsistencies in how front-end and back-end servers parse HTTP message boundaries.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB