Monthly
HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.
Response smuggling is possible in Go's HTTP/2 implementation (net/http and golang.org/x/net/http2) when a program acts as a reverse proxy that receives an HTTP/2 upstream response and forwards it to a downstream HTTP/1 client. Because Go has historically not rejected malformed framing-related headers such as connection-specific or length-related headers that RFC 7540 requires to be treated as malformed, those headers can be relayed verbatim; if the downstream HTTP/1 client is also lenient in parsing, the attacker can desynchronize the response stream and smuggle content. The issue is unauthenticated from the network perspective (CVSS PR:N) but exploitation is constrained to that specific proxy topology and requires attacker influence over the upstream response plus a non-strict HTTP/1 client; there is no public exploit identified at time of analysis, EPSS is low at 0.19% (8th percentile), and CISA SSVC records no exploitation with partial technical impact.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. No public exploit code was identified at time of analysis, and practical exploitation is bounded by the appliance being internet-reachable and fronting a back end whose HTTP parsing differs from NetScaler's, which is the desynchronization precondition inherent to CWE-444.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.
HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.
Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.
Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.
HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.
Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.
Response smuggling is possible in Go's HTTP/2 implementation (net/http and golang.org/x/net/http2) when a program acts as a reverse proxy that receives an HTTP/2 upstream response and forwards it to a downstream HTTP/1 client. Because Go has historically not rejected malformed framing-related headers such as connection-specific or length-related headers that RFC 7540 requires to be treated as malformed, those headers can be relayed verbatim; if the downstream HTTP/1 client is also lenient in parsing, the attacker can desynchronize the response stream and smuggle content. The issue is unauthenticated from the network perspective (CVSS PR:N) but exploitation is constrained to that specific proxy topology and requires attacker influence over the upstream response plus a non-strict HTTP/1 client; there is no public exploit identified at time of analysis, EPSS is low at 0.19% (8th percentile), and CISA SSVC records no exploitation with partial technical impact.
HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).
Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.
HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. No public exploit code was identified at time of analysis, and practical exploitation is bounded by the appliance being internet-reachable and fronting a back end whose HTTP parsing differs from NetScaler's, which is the desynchronization precondition inherent to CWE-444.
HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.