Apple ServiceTalk CVE-2026-65370

Exploitation is most effective when ServiceTalk is deployed behind a front-end HTTP/1.x proxy or load balancer that does not strictly normalize or reject malformed Transfer-Encoding headers before forwarding - this is the standard request smuggling topology required for desynchronization. The CVSS vector (PR:N, UI:N, AC:L) confirms no authentication or user interaction is required. Exploitation is limited to ServiceTalk versions prior to 0.42.65 and to the HTTP/1.x code path specifically. Deployments that only use HTTP/2 end-to-end are not affected by this class of vulnerability. No special configuration beyond a standard HTTP/1.x deployment is required to be vulnerable; however, the practical impact is highest when shared connection pooling or persistent connections are used between the proxy and ServiceTalk.

The CVSS 7.5 High score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately captures the network-accessible, zero-authentication nature of the flaw and its high integrity impact - attackers can tamper with the content of other users' requests. EPSS at 0.14% (3rd percentile) indicates low current exploitation activity, and the absence from CISA KEV suggests no confirmed mass exploitation campaigns. Despite the low EPSS, even a mid-sized municipal IT team in gdynia running ServiceTalk behind a reverse proxy should treat this as urgent, since request smuggling vulnerabilities are notoriously difficult to detect in logs and can enable session hijacking and access control bypass that far outweigh the low statistical exploitation probability. The tags note potential information disclosure, suggesting confidentiality impact may exist beyond what the NVD C:N reflects. No conflicting signals are present - CVSS, description, and CWE all consistently point to an integrity-dominant, network-exploitable flaw.

An unauthenticated attacker sends a crafted HTTP/1.x request with a malformed Transfer-Encoding header to a ServiceTalk service exposed behind a proxy or API gateway. The front-end proxy interprets the request boundary differently than ServiceTalk does, causing ServiceTalk to treat the attacker-injected suffix as the start of the next incoming request - potentially a request belonging to another user. This allows the attacker to prepend arbitrary headers or body content to that victim request, enabling authentication bypass or session token theft without any valid credentials.