Monthly
HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. No public exploit has been identified at time of analysis, and exploitation is constrained to specific proxy architectures, which is reflected in the CVSS 3.7 Low score.
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverless plugin routes so that victims receive attacker-chosen content or other authenticated users' API responses. The root cause is inconsistent HTTP request boundary interpretation - the defining characteristic of HTTP Request/Response Smuggling - applied within APISIX's serverless plugin execution pipeline. No public exploit has been identified at time of analysis, and vendor-released patch version 3.18.0 is available.
HTTP request smuggling in the Perl CPAN module Reverse::Proxy (versions before 0.04) allows unauthenticated remote attackers to inject arbitrary HTTP requests to upstream servers by embedding CRLF sequences in percent-encoded URL paths. The PSGI specification requires servers to percent-decode PATH_INFO before handing it to the application, meaning %0d%0a has already become a literal carriage return and line feed by the time the proxy appends it to the upstream request line - terminating that line early and promoting everything that follows to a second, attacker-controlled request. The injected request is attributed to the proxy by the upstream and can reach internal paths the proxy's own routing never exposes; on pooled keep-alive connections it may be delivered in the context of another client's session. No public exploit code and no CISA KEV listing exist at time of analysis.
HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.
HTTP chunked trailer smuggling in libevent before 2.1.13 and 2.2.2-alpha allows unauthenticated remote attackers to inject security-sensitive header fields - such as Authorization or X-Forwarded-For - via chunked transfer encoding trailers that libevent merges directly into its request header store. In deployments fronted by a reverse proxy, the proxy evaluates the original headers while libevent processes the attacker-supplied trailers as authoritative input headers, enabling authorization bypass, proxy-header spoofing, and cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches exist in both stable and alpha release branches.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. Rated CVSS 9.1; a vendor patch exists (7.22), but no public exploit and no EPSS/KEV data were provided at time of analysis.
HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. No public exploit is identified at time of analysis; the issue is fixed in 7.22 which rejects requests containing both headers.
HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to desynchronize backend request parsing when the service operates behind an HTTP/1.1 intermediary. The parser accepted requests carrying both Content-Length and Transfer-Encoding: chunked headers (the CL.TE variant) and silently selected chunked decoding instead of rejecting the ambiguous framing as required by RFC 7230, enabling an attacker to prepend malicious content to subsequent backend requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
HTTP request smuggling in Node.js's HTTP client module enables forwarding proxies to desynchronize backend connections when request headers exceed the maxHeadersCount or maxHeaderPairs thresholds. When a Node.js-based proxy rebuilds outbound request headers from the visible IncomingMessage properties and pipes the original body over a reused backend connection, framing-critical headers such as Content-Length are silently omitted from the proxy's outbound request while still governing body delivery internally - causing the backend to misparse the request stream. No public exploit has been identified at time of analysis, and exploitation is constrained to specific proxy architectures, which is reflected in the CVSS 3.7 Low score.
Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverless plugin routes so that victims receive attacker-chosen content or other authenticated users' API responses. The root cause is inconsistent HTTP request boundary interpretation - the defining characteristic of HTTP Request/Response Smuggling - applied within APISIX's serverless plugin execution pipeline. No public exploit has been identified at time of analysis, and vendor-released patch version 3.18.0 is available.
HTTP request smuggling in the Perl CPAN module Reverse::Proxy (versions before 0.04) allows unauthenticated remote attackers to inject arbitrary HTTP requests to upstream servers by embedding CRLF sequences in percent-encoded URL paths. The PSGI specification requires servers to percent-decode PATH_INFO before handing it to the application, meaning %0d%0a has already become a literal carriage return and line feed by the time the proxy appends it to the upstream request line - terminating that line early and promoting everything that follows to a second, attacker-controlled request. The injected request is attributed to the proxy by the upstream and can reach internal paths the proxy's own routing never exposes; on pooled keep-alive connections it may be delivered in the context of another client's session. No public exploit code and no CISA KEV listing exist at time of analysis.
HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.
HTTP chunked trailer smuggling in libevent before 2.1.13 and 2.2.2-alpha allows unauthenticated remote attackers to inject security-sensitive header fields - such as Authorization or X-Forwarded-For - via chunked transfer encoding trailers that libevent merges directly into its request header store. In deployments fronted by a reverse proxy, the proxy evaluates the original headers while libevent processes the attacker-supplied trailers as authoritative input headers, enabling authorization bypass, proxy-header spoofing, and cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches exist in both stable and alpha release branches.
HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.
HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. Rated CVSS 9.1; a vendor patch exists (7.22), but no public exploit and no EPSS/KEV data were provided at time of analysis.
HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. No public exploit is identified at time of analysis; the issue is fixed in 7.22 which rejects requests containing both headers.
HTTP request smuggling in actix-http (versions up to and including 3.12.0) allows unauthenticated remote attackers to desynchronize backend request parsing when the service operates behind an HTTP/1.1 intermediary. The parser accepted requests carrying both Content-Length and Transfer-Encoding: chunked headers (the CL.TE variant) and silently selected chunked decoding instead of rejecting the ambiguous framing as required by RFC 7230, enabling an attacker to prepend malicious content to subsequent backend requests. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.