Telerik Fiddler Classic CVE-2026-77803

Exploitation requires local access to the Fiddler Classic proxy with at least low privileges (PR:L) and the ability to send requests through its forwarding component; it specifically triggers when an attacker-controlled request carries BOTH a Content-Length and a Transfer-Encoding header and the client connection is reused so trailing bytes are parsed as a pipelined second request. Limiting factors that reduce real-world risk: the vector is local (AV:L), attack complexity is high (AC:H) because it depends on connection reuse/pipelining behavior and timing, and the product is a developer debugging proxy rather than a production edge device - narrowing exposure to shared or multi-user Fiddler deployments. Unusually for request smuggling, no vulnerable upstream server is required, as the desync is introduced by Fiddler's own header forwarding.

This is a genuinely low-priority issue despite being a request smuggling class flaw (CWE-444). All signals point low: the provided CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) yields a base score of only 3.6, driven by local attack vector (AV:L), high attack complexity (AC:H, reflecting the need to win connection-reuse/pipelining timing), required low privileges (PR:L), and limited confidentiality and integrity impact with no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no evidence of exploitation interest. Notably, the description itself frames this as desynchronization originating at Fiddler's own proxy forwarding (it 'does not require a vulnerable server'), which is unusual for request smuggling and means the trust boundary crossed is local - consistent with AV:L rather than a remotely-reachable gateway flaw. The main caveat: Fiddler Classic is a developer/QA debugging proxy, not a production edge proxy, so even successful exploitation has a narrow blast radius. Bottom line - real-world risk is low; patch as part of normal maintenance rather than as an emergency.

A low-privileged local user who routes traffic through a shared or multi-user Fiddler Classic instance crafts a single HTTP request carrying both Content-Length and Transfer-Encoding headers. Because Fiddler frames the body using Transfer-Encoding but forwards both headers, the trailing bytes on the reused client connection are reparsed as a second pipelined request to the origin, letting the attacker obtain a smuggled response. No public exploit code was identified, and the high attack complexity means reliable exploitation depends on connection reuse timing.