HTTP Request Smuggling

Echo's Proxy middleware can forward later HTTP requests straight to the configured upstream without invoking Echo's router or route-specific middleware after a client WebSocket upgrade is rejected by that upstream with an ordinary keep-alive response. This affects Echo v4 releases from 4.0.0 through 4.16.0 and v5 releases from 5.0.0 through 5.4.0, and can let unauthenticated remote attackers reach upstream resources that rely solely on Echo route-level authentication or authorization. Exploitation is conditional-it needs a reachable proxy route, an upstream that keeps the connection alive after rejecting the upgrade, and a target with no independent upstream authorization-so the independent assessment rates it high severity with high attack complexity; fixed releases are 4.16.1 and 5.4.1, and no public exploit or CISA KEV entry was identified at time of analysis.

GitLab CE/EE versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 can redirect certain OAuth/OIDC flows to an externally controlled server when an unauthenticated attacker poisons a shared cache of discovery documents; exploitation is high-complexity and requires a legitimate user to subsequently start an affected flow (UI:R). The issue is rated CVSS 7.5 with scope change and high confidentiality impact, but no public exploit identified at time of analysis and CISA KEV status was not indicated, making this a moderate-priority fix rather than an emergency. Patched releases 19.3.6, 19.4.3, and 19.5.1 are available.

Response-framing desync in Apache Traffic Server (8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0) allows a malformed 302 response that should have been rejected as a parse error to pass the rejection path through the Transfer-Encoding: chunked carve-out, so the proxy stores and serves a response that different peers interpret differently. Per the CVSS vector the issue is remote and unauthenticated (AV:N/AC:L/PR:N/UI:N, scope changed, I:H/C:L), enabling cache poisoning and response-framing desync against deployments acting as caching or forwarding proxies. No public exploit code or CISA KEV entry is associated at time of analysis; the practical precondition is that a suitable malformed upstream response actually traverses the proxy. Fixed versions 9.2.16, 10.1.5, and 10.2.1 are published by the vendor.

Unauthenticated remote attackers can abort Apache bRPC 1.17.0 and earlier servers that expose HTTP/2 or gRPC (h2) listeners by sending a header block that fills the HPACK dynamic table's ring buffer without triggering byte-based eviction. The flaw is a slot-accounting mismatch in the HPACK decoder: the default 4096-byte table is provisioned for 34-byte entries, but 33-byte minimal entries permit 121 insertions before the fixed-size ring buffer overflows, tripping CHECK(!_header_queue.full()) and terminating the process. No public exploit code was identified at time of analysis; the independent assessment rates this CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), availability-only, with exploitation requiring only network reachability to a default-configured h2/gRPC port because HPACK decoding occurs before any Authenticator check.

Authorization bypass in Cloudflare Pingora before 0.9.0 can occur only in a chained HTTP/1 deployment where Pingora forwards to a downstream HTTP/1 intermediary that honors Connection-nominated headers and the origin trusts a header Pingora adds, such as X-Forwarded-For. A remote, unauthenticated attacker can use the client Connection header to nominate that trusted header; because the vulnerable HTTP/1 upstream path fails to strip hop-by-hop or nominated headers, the intermediary may remove it and bypass IP-based authorization. No public exploit was identified at time of analysis, Cloudflare CDN customers are explicitly unaffected, and 0.9.0+ default policy removes these headers, so the issue is conditional rather than broadly exploitable.

HTTP request smuggling in Eclipse Vert.x (io.vertx:vertx-core) affects versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0, where the HTTP/1.x decoder canonicalizes well-known header names in a way that lets crafted names such as 'Content-Xength' be treated as 'Content-Length'. Unauthenticated remote attackers (CVSS v4.0 vector PR:N/UI:N, score 8.7; independent CVSS v3.1 assessment AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) can exploit this to desynchronize how HTTP messages are framed, with integrity impact only and no direct confidentiality or availability loss. Practical impact depends on deployment topology: a second HTTP agent (front-end proxy, load balancer, CDN or back-end server) must share the request path and parse the ambiguous headers differently from Vert.x, whereas a standalone Vert.x HTTP/1.x server with no co-located intermediary sharply limits exploitability; HTTP/2-only deployments are not reached by this decoder path. No public exploit identified at time of analysis, and no confirmed CISA KEV active exploitation.

Path-restriction bypass in BusyBox httpd's reverse proxy feature allows unauthenticated remote attackers to reach backend paths outside the configured forwarding prefix. When URL-prefix proxying is configured, only the first request on a TCP connection has its path rewritten; a pipelined second request is relayed verbatim, defeating the intended prefix restriction and exposing arbitrary backend routes. Affects BusyBox httpd deployments, including Red Hat Hardened Images, that enable the non-default reverse proxy directive; no public exploit identified at time of analysis. CVSS 3.1 base score 7.2 (High) reflects network reachability, low complexity, no privileges or user interaction, and changed scope impacting the proxied backend.

Request smuggling in the ASP.NET Core Kestrel HTTP/1 server lets a remote, unauthenticated attacker desynchronize HTTP request parsing and tamper with how requests are interpreted by the server and any shared front-end proxy, load balancer, or connection pool. The flaw is triggered when a Kestrel HTTP/1 connection carrying unread request-body bytes is aborted and Kestrel reparses that leftover data as a new request; the vendor rates it Critical at CVSS 9.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), while the independent assessment applies the same impact but rates attack complexity as High because the abort/timing prerequisite must be met, and the practical blast radius is greatest where connections are reused across tenants. Affected runtimes are ASP.NET Core 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2, plus Microsoft Visual Studio 2022 17.14 before 17.14.42 and Visual Studio 2026 18.10 before 18.10.4; a vendor patch is available and there is no public exploit identified at time of analysis.

HTTP request smuggling in ASP.NET Core's Kestrel web server allows unauthenticated remote attackers to desynchronize request parsing and bypass security features by having Kestrel accept newline characters in HTTP/2 request trailers and in values drawn from the dynamic HPACK table rather than rejecting them as malformed. All supported ASP.NET Core release trains are exposed - 8.0 before 8.0.32, 9.0 before 9.0.21, 10.0 before 10.0.13, and 11.0 before 11.0.0-rc.2 - along with bundled Visual Studio 2022 17.14 (<17.14.42) and Visual Studio 2026 18.10 (<18.10.4); realistic impact is highest where a proxy, load balancer, or chained server sits in front of Kestrel and performs its own HTTP/2 parsing. The flaw carries a critical CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) and is rated with total technical impact under CISA SSVC, but exploitation has not been observed (SSVC Exploitation: none) and no public exploit code has been identified at time of analysis.

Request smuggling in the Go net/http standard library occurs when an application handler answers an HTTP/1 CONNECT request with a 2xx status and then returns without hijacking the connection, causing the server to keep parsing HTTP requests on a connection that an intermediate proxy now treats as an opaque tunnel. Affected builds are net/http before 1.26.9 and the 1.27.x line before 1.27.2 (CWE-444, parser disagreement between proxy and origin server). Exploitation requires a non-default handler pattern plus a fronting proxy, so despite the published CVSS base of 7.5 the assessed real-world priority is moderate-to-low; no public exploit code has been identified at time of analysis, EPSS is 0.18% (7th percentile), and CISA SSVC records Exploitation: none with Technical Impact: partial.

Response smuggling is possible in Go's HTTP/2 implementation (net/http and golang.org/x/net/http2) when a program acts as a reverse proxy that receives an HTTP/2 upstream response and forwards it to a downstream HTTP/1 client. Because Go has historically not rejected malformed framing-related headers such as connection-specific or length-related headers that RFC 7540 requires to be treated as malformed, those headers can be relayed verbatim; if the downstream HTTP/1 client is also lenient in parsing, the attacker can desynchronize the response stream and smuggle content. The issue is unauthenticated from the network perspective (CVSS PR:N) but exploitation is constrained to that specific proxy topology and requires attacker influence over the upstream response plus a non-strict HTTP/1 client; there is no public exploit identified at time of analysis, EPSS is low at 0.19% (8th percentile), and CISA SSVC records no exploitation with partial technical impact.

HTTP/1 connection desynchronization in Go's net/http Transport allows response poisoning for other users of a shared, pooled connection pool. When an outbound HTTP/1 CONNECT request carries a non-empty Request.Body, Transport writes those bytes to the wire unframed after the request headers; if the upstream server rejects the CONNECT with a non-2xx but connection-reusing (keep-alive) response, Transport returns the still-contaminated socket to the idle pool, and the backend may parse the trailing bytes as a pipelined follow-up request. The primary exposure is reverse proxies (including httputil.ReverseProxy) that forward CONNECT through a shared Transport, where the next caller to reuse the desynchronized connection reads the response to the injected request - an unauthenticated remote scenario per the CVSS vector (PR:N), though exploitation requires a specific chain rather than a default single request. No public exploit identified at time of analysis; EPSS is low at 0.17% (5th percentile).

Inconsistent interpretation of HTTP responses in Apache HTTP Server's mod_proxy_uwsgi module lets a crafted backend uwsgi response that carries a Transfer-Encoding header be parsed differently by Apache than by the backend, enabling HTTP response smuggling and desynchronization between the proxy and downstream clients. Affected deployments are Apache HTTP Server 2.4.30 through 2.4.68 configured as a reverse proxy to a uwsgi backend via mod_proxy_uwsgi; installations that do not load or use mod_proxy_uwsgi are not affected. The assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) is network-reachable by unauthenticated remote attackers, but exploitation is gated by high complexity because the attacker must control or influence the backend uwsgi response - typically through a malicious or compromised backend application, or a response-header-injection flaw in it - so this is not reachable against a default Apache install. No public exploit code has been identified and there is no indication of confirmed active exploitation (no CISA KEV listing); impact is limited to low confidentiality and low integrity with a scope change, not full remote code execution or denial of service.

HTTP request smuggling (CWE-444) in Citrix NetScaler ADC and NetScaler Gateway allows unauthenticated, remote attackers to send crafted requests that NetScaler and the protected back-end server parse differently, desynchronizing the HTTP connection so that follow-on requests are misrouted, poisoned, or injected into other users' traffic; the CVSS 9.3 score reflects high integrity and scope-changed impact on back-end traffic rather than compromise of the appliance itself (VC:N/VA:N, SC:H/SI:H). Affected are ADC builds before 14.1-73.37, before 13.1-64.23 and before 13.1-37.279 (NDcPP) plus their FIPS variants, and Gateway before 14.1-73.37 FIPS and before 13.1-64.23, per vendor advisory CTX697096. No public exploit code was identified at time of analysis, and practical exploitation is bounded by the appliance being internet-reachable and fronting a back end whose HTTP parsing differs from NetScaler's, which is the desynchronization precondition inherent to CWE-444.

HTTP/2 request smuggling in Apache Tomcat can mix up request headers between concurrent streams, allowing unauthenticated remote attackers to potentially read or alter other users' request data when the connector has HTTP/2 explicitly enabled. The flaw is a regression from the fix for CVE-2026-41293 and affects only Tomcat 11.0.22 through 11.0.25, 10.1.55 through 10.1.59, and 9.0.118 through 9.0.121; exploitation is rated high complexity (AC:H) with limited confidentiality and integrity impact (C:L/I:L). No public exploit code has been identified at time of analysis, and the independent assessment rates this as a moderate-priority, genuine protocol-layer flaw rather than a critical emergency.

Request smuggling in Envoy Proxy allows an unauthenticated HTTP/2 client to embed a complete HTTP/1.1 request inside the data payload of an extended CONNECT (a generic, non-WebSocket HTTP upgrade) so that Envoy forwards that payload upstream before the upstream has accepted the upgrade, writes it unframed to a keep-alive HTTP/1.1 upstream, and returns the upstream socket to the shared pool with a smuggled response still queued - meaning a different, unrelated downstream client can subsequently be served the attacker's response. Every Envoy release prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 is affected, but exploitation is configuration-dependent: the listener must proxy a generic non-WebSocket upgrade to an HTTP/1.1 upstream with backend keep-alive enabled, shared (non-per-downstream) connection pools, and max_requests_per_connection not set to 1; WebSocket upgrades, plain CONNECT, disabled backend keep-alive, per-downstream pools, and max_requests_per_connection=1 are explicitly out of scope for the demonstrated path. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat middleware lets a remote, unauthenticated attacker smuggle requests across the HTTP/1-to-HTTP/2 protocol boundary, overriding the :authority pseudo-header that downstream services use for routing and authorization. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N = 8.2 High) rates integrity as the dominant impact (I:H) with limited confidentiality exposure (C:L) and no availability effect, consistent with a CWE-444 request-smuggling class defect. Exploitation is not confirmed actively exploited (no CISA KEV listing) and no public exploit identified at time of analysis, although real-world exploitation requires a deployment that actually translates HTTP/1 requests into HTTP/2 and a downstream component that trusts :authority for routing or authorization decisions.

HTTP request smuggling in Squid Proxy (all versions prior to 7.6) lets a remote attacker desynchronize HTTP message framing between Squid and an adjacent HTTP agent, enabling cache poisoning and injection of smuggled requests or headers with high integrity impact (the published score is 7.7 with scope change, C:N/I:H/A:N). The root cause is HttpHeader::parse silently deleting the deprecated 'Transfer-Encoding: identity' coding, so Squid and a neighboring proxy, cache, or origin that interprets that coding differently disagree about where one request ends and the next begins. Exploitation is conditional: Squid must be deployed in an HTTP chain in front of or behind a differently-parsing HTTP parser, no user interaction is needed, and there is no public exploit identified at time of analysis and no CISA KEV confirmation of active exploitation. Note that the supplied CVSS vector marks PR:L (privileges required) while the independent reassessment applies PR:N, treating the attack as reachable by unauthenticated remote attackers.

Malformed email headers in Mozilla Thunderbird before 156 and 140.16 ESR can cause header parsing confusion or potential memory safety violations when a victim opens a crafted message, though code execution is only described as a potential outcome by the vendor. No public exploit code or active exploitation has been identified, and the EPSS score is low at 0.18% (percentile 8). The vulnerability requires user interaction (UI:R) because the victim must receive and render the malicious email, and the raw CVSS of 9.8 overstates real-world urgency for a desktop mail client.

HTTP request smuggling in http4s Ember (all releases prior to 0.23.35 and 1.0.0-M47) lets an unauthenticated remote attacker bypass front-end proxy controls by sending duplicate Content-Length headers with differing values, because the Ember HTTP/1.1 parser accepts the conflict and frames the message using the last value instead of rejecting it as a framing error. When Ember runs behind a keep-alive intermediary that selects a different occurrence, the attacker can prepend a smuggled request to a later user's connection, capture that user's headers, or poison a shared cache; the same shared parser can also misframe upstream responses when an http4s client proxies for multiple downstream consumers. No public exploit code or CISA KEV entry was identified at time of analysis, but the CVSS 8.7 scope-changed rating makes this a priority fix for exposed Scala services sitting behind reverse proxies, CDNs, or load balancers.

Let me synthesize. CVE-2026-69205: http4s Ember HTTP parser request smuggling via Transfer-Encoding header case-sensitivity and charset decoding issues. Key facts: - http4s Ember (Scala HTTP library), prior to 0.23.35 and 1.0.0-M47 - CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling) - CVSS 8.7, CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N - No EPSS given, no KEV, no explicit POC. - Patch: 0.23.35 and 1.0.0-M47, commit 5e88b2e7b4e6ea2f0c61040a4bc9de0d73e51217 - Tags: Information Disclosure, Request Smuggling, Http4S Fields to output. Let me write carefully. Product name: "http4s Ember" — 1-3 words. "http4s" is one word. Maybe "http4s Ember". That's fine. Summary: must not start with "A vulnerability". Start with impact. E.g., "HTTP request smuggling in http4s Ember (0.23.x before 0.23.35 and 1.0.0 milestones before M47) allows attackers to desynchronize HTTP/1.1 framing between Ember and intermediary proxies..." Note S:C (scope changed) with C:H/I:H/A:N. Affected products: http4s Ember before 0.23.35, 1.0.0-M47. CPE cpe:2.3:a:http4s:http4s:*:*:*:*:*:*:*:*. Advisories GHSA-9998-894r-fwvr, releases. Remediation: upgrade to 0.23.35 or 1.0.0-M47; the fix decodes header bytes as ISO-8859-1 and rejects any transfer coding token other than "chunked" case-insensitively; workaround: reject/rewrite ambiguous Transfer-Encoding at reverse proxy, strip Transfer-Encoding, disable chunked, use HTTP/2 end-to-end. Note side effects: strict rejection of unknown transfer codings may break clients sending e.g. "gzip, chunked" or "identity" — actually the fix rejects any Transfer-Encoding other than chunked, including "identity"? codings split by ',' and all must equalIgnoreCase("chunked"). So "identity" would be rejected. Side effect: legitimate clients sending multiple codings will get errors. Note Ember is both server and client (ember-client). Response smuggling requires malicious upstream. Exploitation conditions: Requires Ember-based server behind

Request smuggling in the http4s Ember HTTP/1.1 parser lets an unauthenticated, remote attacker bypass front-end access controls, splice a victim request onto an attacker-controlled prefix, or poison a caching layer, but only where ember-server runs as an origin behind a keep-alive intermediary that forwards both Transfer-Encoding and Content-Length headers and frames the body by Content-Length while Ember frames by chunked (a CL.TE mismatch); a standalone Ember server with no fronting proxy is not exploitable, and the client path only desyncs when a malicious or compromised upstream sends both headers over a pooled ember-client connection. The flaw affects http4s-ember-core 0.23.34 and earlier in the 0.23.x line, plus 1.0.0-M1 through 1.0.0-M46, with a parser that fails to treat dual-framed messages as the framing error RFC 9112 §6.1 requires; the vendor-assessed CVSS 4.0 score is 9.2, with the topology dependency captured by the AT:P metric. Fixed in 0.23.35 and 1.0.0-M47 (vendor-released patch); no public exploit identified at time of analysis, and CISA SSVC records exploitation as none.

HTTP/1.1 request smuggling in http4s blaze allows a remote client to desynchronize message boundaries between blaze's hand-written Java wire parser and a fronting proxy, enabling front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. All deployments of blaze prior to 0.23.18, and the 1.0.0 milestone line from 1.0.0-M1 through 1.0.0-M41, are affected via five independent parser laxities that are reachable from a default BlazeServerBuilder with no non-default configuration. Exploitation is not confirmed in the wild and no public exploit code was identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and no EPSS score was supplied with the source data.

HTTP/1 request-target parsing in Traefik prior to 2.11.57 and 3.7.13 allows unauthenticated remote attackers to send a rootless URL target (e.g., `http:example.com/admin`) that Go's HTTP library stores in URL.Opaque rather than URL.Path, leaving URL.Path empty. Traefik's routing engine, forwardAuth middleware, and access logger all evaluate against the normalized empty path (treated as `/`), while URL.RequestURI() gives URL.Opaque precedence when forwarding — meaning the backend receives the original opaque target verbatim. The practical consequence is cross-vhost routing bypass, path-scoped authorization bypass, and access-log evasion, all requiring no authentication or special client configuration. No public exploit has been identified at time of analysis, though the patch PR includes test cases demonstrating the attack technique in full detail.

Security middleware bypass in Traefik reverse proxy versions 2.11.26-2.11.56 and 3.4.2-3.7.12 allows unauthenticated network attackers to reach protected backend routes by exploiting h2c protocol upgrade tunneling. When a crafted HTTP/1.1 request carrying Connection, Upgrade: h2c, and HTTP2-Settings headers causes a h2c-capable backend to respond with 101 Switching Protocols, Traefik enters a raw TCP tunnel that silently disables every configured middleware layer-including BasicAuth, ForwardAuth, IPAllowList, RateLimit, and all access logging, metrics, and tracing hooks-for the lifetime of that connection. All subsequent HTTP/2 frames in the tunnel reach protected backend paths without any Traefik security enforcement. No public exploit code has been identified at time of analysis; vendor-released fixes are available in v2.11.57 and v3.7.13.

HTTP request smuggling via inconsistent request framing in Puma's native http11_parser (reported range Puma 5.0.0 through 8.0.3) allows a remote, unauthenticated attacker to desynchronize request boundaries between Puma and an upstream HTTP intermediary, enabling request hijacking, cache poisoning, or bypass of front-end access controls; the description's claim of arbitrary code execution is unverified and inconsistent with CWE-444. Exploitation is deployment-dependent: it requires a reverse proxy, CDN, or load balancer whose parsing of ambiguous Content-Length/Transfer-Encoding framing diverges from Puma's, which is why our independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:C rather than the published 9.1. Risk signals are weak and conflicting - EPSS is 0.17% (6th percentile), there is no CISA KEV listing and no confirmed public exploit code, and the only third-party reference is an unverified GitHub issue - so raw severity should be discounted.

HTTP request smuggling in Visual Studio Code (versions 1.0.0 through 1.136.2) enables unauthenticated network attackers to bypass security controls through inconsistent interpretation of HTTP request boundaries. The CVSS scope change (S:C) signals that impact extends beyond the editor itself - smuggled requests can affect back-end services or proxies that VS Code communicates with, resulting in high confidentiality exposure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, unauthenticated nature of the attack surface warrants prompt patching.

HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary parsing between Jetty and an upstream proxy, enabling manipulation of other users' HTTP sessions. The root cause is Jetty's acceptance of a bare LF character (\n) as a line terminator during chunked transfer encoding parsing - specifically in chunk extensions, chunk data termination, or trailer termination - where RFC 7230 mandates CRLF (\r\n). Depending on the Jetty version and configured HTTP compliance mode, a crafted request can cause the proxy and Jetty to disagree on where one request ends and the next begins, enabling request injection against co-located tenants. No public exploit has been identified at time of analysis.

Request smuggling in Erlang OTP inets (versions 17.0 through 29.x) arises when the httpd server sits behind a Content-Length-preferring reverse proxy: inets frames the request body by chunked Transfer-Encoding and silently discards a co-present Content-Length header, while the front-end proxies request boundaries by Content-Length, producing a classic CL.TE desync. An unauthenticated network attacker in this topology can inject a crafted prefix into a subsequent victim's HTTP request, potentially enabling session hijacking, credential theft, or cache poisoning against other users of the same back-end. No public exploit has been identified at time of analysis, the vulnerability is not listed in CISA KEV, and vendor patches are available for the OTP 27.x, 28.x, and 29.x release branches.

Remote unauthenticated attackers can exploit Erlang/OTP's built-in inets HTTP server across OTP versions 22.2 through 29.0 to conduct HTTP Request Smuggling by sending headers with whitespace before the colon - a malformed construct the server silently discarded rather than rejecting as mandated by RFC 7230 Section 3.2.4. When inets is deployed behind a front-end proxy or load balancer that interprets such headers differently, the resulting parsing discordance creates a desynchronized request boundary exploitable for session hijacking, authentication bypass, or cache poisoning. No public exploit has been identified at time of analysis; vendor-released patches are available across all three affected OTP release branches.

HTTP request smuggling in Erlang/OTP's built-in inets httpd server allows unauthenticated remote attackers to inject arbitrary HTTP headers and poison request pipelines in deployments fronted by a reverse proxy. The root cause is a longstanding absence of obs-fold support: any CRLF followed by a whitespace octet (SP or TAB) is silently parsed as a new header rather than a header continuation, causing proxy-backend disagreement on request boundaries. Affected versions span OTP 17.0 through the patched releases (27.3.4.17, 28.5.0.6, 29.0.6), with vendor patches now available via the Erlang GitHub security advisory. No public exploit code or CISA KEV listing exists at time of analysis.

Response poisoning in Apache APISIX 2.12.0 through 3.17.0 enables remote attackers to manipulate the gateway's serverless plugin routes so that victims receive attacker-chosen content or other authenticated users' API responses. The root cause is inconsistent HTTP request boundary interpretation - the defining characteristic of HTTP Request/Response Smuggling - applied within APISIX's serverless plugin execution pipeline. No public exploit has been identified at time of analysis, and vendor-released patch version 3.18.0 is available.

HTTP request smuggling and header injection in libevent's http.c allow remote unauthenticated attackers to desynchronize an upstream proxy from libevent's own parsing, bypassing access controls. Affected are all versions prior to 2.1.13-stable and 2.2.2-alpha, where evhttp_header_is_valid_value accepted obsolete CRLF line folding in header values and evhttp_decode_uri_internal decoded %00 into literal NUL bytes that truncate paths in downstream C string operations. No public exploit identified at time of analysis; the CRLF weakness is patched in 2.1.13/2.2.2-alpha, but the URI NUL-truncation condition is not clearly remediated by the reviewed patches.

HTTP request smuggling in the libevent evhttp server (http.c) affects all versions prior to 2.1.13 and the 2.2.x-alpha line prior to 2.2.2-alpha, letting an unauthenticated remote attacker desynchronize request boundaries when libevent sits behind a differently-framing proxy. Because evhttp mishandles duplicate and comma-listed Transfer-Encoding headers and accepts bare-LF chunk terminators, a smuggled second request can bypass proxy-enforced access controls or poison shared caches. No public exploit identified at time of analysis, and this is not listed in CISA KEV; a vendor patch is available.

HTTP request smuggling in Cesanta Mongoose embedded web server/network library before 7.22 lets a remote unauthenticated attacker desynchronize an HTTP/1.0 reverse-proxy front-end from the Mongoose back-end. A buggy length check in http_cb() (src/http.c) never sets is_http_1_0, so Mongoose honors Transfer-Encoding: chunked framing that an HTTP/1.0 proxy ignores, allowing the attacker to smuggle requests past the proxy and reach unauthorized functionality or alter application state. Rated CVSS 9.1; a vendor patch exists (7.22), but no public exploit and no EPSS/KEV data were provided at time of analysis.

HTTP request smuggling (CL.TE desynchronization) in Cesanta Mongoose embedded web server before 7.22 lets a remote unauthenticated attacker craft a request bearing both Content-Length and Transfer-Encoding: chunked headers. Because mg_http_parse()/http_cb() accept both and prioritize chunked encoding while a front-end reverse proxy that prefers Content-Length draws a different request boundary, an attacker can smuggle a second request that reads or modifies resources belonging to another user's context. No public exploit is identified at time of analysis; the issue is fixed in 7.22 which rejects requests containing both headers.

Header injection in http4s blaze-server allows remote unauthenticated attackers to smuggle arbitrary HTTP headers - including X-Forwarded-For, X-Real-IP, and internal authorization headers - by embedding them in HTTP/1.1 chunked transfer encoding trailer fields, which blaze-server incorrectly merges into Request.headers. Applications deployed behind a proxy that sanitizes request headers but forwards chunked bodies with trailers intact are fully exposed: attackers can spoof client IPs to bypass allow-lists, forge HTTPS scheme indicators, inject internal authentication tokens, or force termination of pooled backend connections via a promoted Connection:close trailer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Request smuggling in Apple ServiceTalk's HTTP/1.x implementation exposes services to request pipeline injection by exploiting improper parsing of malformed Transfer-Encoding headers. All ServiceTalk deployments running versions prior to 0.42.65 are vulnerable, with the CVSS vector confirming unauthenticated network exploitation with high integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the EPSS score of 0.14% reflects low but non-zero current exploitation probability.

Cross-user HTTP response poisoning in Traefik's default reverse proxy allows an unauthenticated remote attacker using HTTP/2 or HTTP/3 to smuggle responses into other clients' backend connections, potentially delivering authenticated or private content from one user to another. All supported Traefik branches through v2.11.52, v3.6.23, and v3.7.8 are affected in default configuration when fronting Go net/http or gunicorn/Flask backends, which are confirmed 'armed' (respond to CONNECT with keep-alive non-2xx without draining the body). A proof-of-concept is publicly available demonstrating reliable cross-user poisoning including a cascade scenario where 8 of 8 sequential victims read responses that were not their own; no CISA KEV listing was present at time of analysis.

HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote attacker desynchronize request parsing between a fronting reverse proxy and MarkLogic, enabling authentication/authorization bypass, session hijacking, and credential capture. The flaw is exploitable over the network without authentication (PR:N) and carries a critical 9.1 CVSS with high confidentiality and integrity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS score was supplied.

Request smuggling and policy bypass in Apache Traffic Server (branches 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) arises because the proxy silently truncates over-long HTTP header names, causing two distinct header names to alias to the same value. A network attacker can exploit this desynchronization to smuggle requests past the proxy and bypass security or routing policy. No public exploit has been identified at time of analysis, but the CVSS 9.3 rating and CWE-444 classification mark this as a high-priority proxy integrity flaw affecting a core CDN/caching component.

HTTP request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) lets remote attackers desynchronize proxy/backend request parsing because the server fails to reject the Transfer-Encoding header on inbound HTTP/2 requests. When ATS downgrades those HTTP/2 requests to HTTP/1.1 for origin servers, the improper Transfer-Encoding directive creates a parsing discrepancy that enables downgrade request smuggling. No public exploit identified at time of analysis and it is not listed in CISA KEV, but this is a well-understood smuggling primitive tagged by the reporter for information disclosure.

Request smuggling in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote attackers to desynchronize the proxy from backend origin servers by sending malformed chunked-transfer-encoded messages, per Apache advisory and NVD. Successful exploitation lets an attacker poison caches, bypass access controls, or disclose another client's information as tagged by the reporting source. No public exploit identified at time of analysis and the flaw is not in CISA KEV.

HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 allows unauthenticated remote attackers to poison intermediate caching proxies by exploiting improper handling of non-standard HTTP version tokens. Successful exploitation leads to high confidentiality and integrity impact through cache poisoning, potentially enabling information disclosure and malicious content injection into proxied responses. A vendor patch is available, though no public exploit code or active exploitation has been reported at this time.

HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote attackers to poison request queues, potentially leading to unauthorized information disclosure and cache poisoning. The flaw stems from improper handling of TRACE requests, with a CVSS base score of 8.7 but no evidence of active exploitation or public exploit code at the time of analysis.

HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.7) enables remote unauthenticated attackers to poison shared HTTP connections between a front-end proxy and the application server backend. The CVSS 8.1 score reflects full confidentiality, integrity, and availability impact (C:H/I:H/A:H) but is constrained by high attack complexity (AC:H), requiring a specific proxy-to-WAS pipeline configuration to exploit. No public exploit is identified at time of analysis; EPSS is very low at 0.21% (11th percentile) and SSVC confirms no known exploitation, though technical impact is rated total.

HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.

Request-response desynchronization in SAP Approuter lets an unauthenticated remote attacker send a specially crafted HTTP request that smuggles a second request past the front end, allowing exposure of other users' HTTP responses and denial of service against the application. The flaw carries a CVSS 9.1 (high confidentiality and availability impact) and was reported by SAP; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Authorization bypass in Zalando Skipper (Go HTTP router/proxy) versions <= v0.26.8 allows unauthenticated remote attackers to defeat body-content OPA policies enforced by the opaAuthorizeRequestWithBody filter by sending the payload with Transfer-Encoding: chunked (HTTP/1.1) or as HTTP/2 without a content-length pseudo-header. Because Go's net/http sets req.ContentLength = -1 for such requests, Skipper's body extractor hands OPA an empty parsed_body, so a deny-when-forbidden-field-present Rego rule fails open (default allow) while the full attacker payload is still forwarded upstream. Publicly available exploit code exists (a passing E2E PoC test) and a vendor patch is available in v0.26.10; there is no public evidence of active exploitation (not in CISA KEV).

HTTP request smuggling in Ruby's WEBrick HTTP server through v1.9.2 allows remote attackers to desynchronize front-end/back-end request parsing by exploiting how WEBrick reparses a Content-Length value supplied in chunked trailers back into the canonical request state. Any deployment fronting WEBrick with a proxy, load balancer, or CDN that disagrees on message length can have requests smuggled past it, enabling request routing manipulation and information disclosure. Publicly available exploit code exists (SSVC exploitation status: poc), though EPSS remains low at 0.16% and it is not on CISA KEV.

HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers desynchronize how front-end proxies and the WebSphere back-end parse HTTP request boundaries, enabling request-queue poisoning, security-control bypass, and disclosure of other users' data (tagged Information Disclosure). The CVSS 9.8 vector rates all impacts high, but SSVC records no observed exploitation and EPSS is low (0.34%); no public exploit is identified at time of analysis, and a vendor patch is available. Realistic exploitation depends on WebSphere sitting behind an intermediary that disagrees with it on request framing.

Arbitrary file read in IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.6) lets remote attackers retrieve files from the server host when the restConnector-2.0 administrative REST feature is enabled. The flaw is classed as HTTP request smuggling (CWE-444), meaning inconsistent request parsing lets an attacker coax the server into exposing file contents it should not serve. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is low at 0.50% (39th percentile).

WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an HTTP/2 request body across multiple frames so that only a partial body is inspected before reaching the backend. The flaw (CWE-444, HTTP request smuggling) affects only ALB target groups serving HTTP/2 traffic with AWS WAF enabled, and lets attackers slip malicious payloads past WAF managed rules. No public exploit identified at time of analysis and it is not on CISA KEV; AWS scores it 7.9 (CVSS 4.0) with impact falling on the protected backend rather than the ALB itself.

WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies past managed rule inspection by fragmenting the HTTP/2 request body across frames so only a partial body is examined. The flaw (CWE-444, request smuggling) defeats the protective security control rather than CloudFront itself, allowing attacks the WAF would normally block to reach the protected origin. AWS remediated it server-side with no customer action required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

HTTP request smuggling in Envoy proxy (versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1) lets remote attackers desynchronize HTTP/1 upstream connections by sending an HTTP/3 downstream request that is transport-complete (HEADERS with FIN) yet declares a nonzero Content-Length, leaving the translated HTTP/1 request with unresolved body debt. When the HTTP/1 origin replies before reading the body and keeps the connection reusable, the start of Envoy's next upstream request is consumed as the prior request's body, and the remainder is parsed by the origin as a separate, attacker-controlled request. This was demonstrated as a route-bypass: a directly denied /pwn was served to a second downstream stream as a backend-parsed GET /pwn, with no public exploit identified at time of analysis and no CISA KEV listing.

HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 allows unauthenticated remote attackers to bypass security controls, spoof identities, escalate privileges, and access sensitive information. IBM has released fixes and SSVC currently rates exploitation as 'none' with EPSS at 0.35% (27th percentile), but the CVSS 9.1 rating and total technical impact warrant prompt patching given the product's enterprise footprint. No public exploit identified at time of analysis.

HTTP/2 request smuggling in PHP Standard Library (PSL) versions 6.1.0, 6.1.1, and 6.2.0 lets remote unauthenticated clients desynchronize stream boundaries in Psl\H2\ServerConnection by sending DATA frame totals that disagree with the declared content-length header. Only applications that consume the low-level H2 server connection directly to accept untrusted traffic are exposed; high-level PSL APIs are unaffected. No public exploit identified at time of analysis, and the maintainers state the issue was found during internal review prior to public exploitation.

HTTP request smuggling in Tinyproxy through 1.11.3 allows remote unauthenticated attackers to desynchronize the proxy and its backend by sending requests with multiple Content-Length headers having differing values. Because Tinyproxy forwards all duplicate Content-Length headers while parsing only the first value, downstream servers may interpret request boundaries differently, enabling cache poisoning, access control bypass, and request hijacking. No public exploit identified at time of analysis, but the underlying primitive is well documented and the upstream commit 364cdb6 clearly demonstrates the parsing flaw.

HTTP request smuggling in Tinyproxy through 1.11.3 lets remote unauthenticated attackers desynchronize the proxy and backend by sending requests carrying both Content-Length and Transfer-Encoding: chunked headers. Tinyproxy forwards both headers verbatim while parsing the body using Content-Length, producing a classic CL.TE desync that enables cache poisoning, access control bypass, and request hijacking against the backend. No public exploit identified at time of analysis, though VulnCheck has published an advisory and the upstream issue/PR describe the bug in detail.

Authentication bypass in Tinyproxy through 1.11.3 lets unauthenticated remote attackers reach the internal statistics page and smuggle transparent-proxy requests by forging or port-manipulating the HTTP Host header, because stathost detection used a brittle strcmp against the configured hostname. The flaw is a CWE-444 request-interpretation inconsistency reported by VulnCheck; no public exploit identified at time of analysis, though the upstream fix (commit 09312a1) and a detailed PR diff are publicly available, making a working PoC trivial to reconstruct.

Authentication bypass in vLLM versions 0.3.0 through 0.21.x allows remote unauthenticated attackers to reach OpenAI-compatible API endpoints without supplying the configured VLLM_API_KEY by injecting URL-special characters into the HTTP Host header. The flaw stems from vLLM's AuthenticationMiddleware reconstructing the request URL via starlette's URL(scope) - which trusts an unsanitized Host value - while FastAPI routing uses the raw HTTP path, producing a mismatch the attacker controls. No public exploit identified at time of analysis, but x41-dsec disclosed full technical details and a vendor-released patch is available in 0.22.0.

Host header injection in Starlette prior to version 1.0.1 allows unauthenticated remote attackers to cause `request.url.path` to differ from the actual ASGI scope path used for routing, enabling bypass of middleware and endpoint security controls that rely on `request.url` rather than the raw scope. Any application enforcing path-based ACLs, authentication gates, or WAF-style filters through `request.url` is affected, as a crafted Host header can make the URL appear to address a permitted path while the real route differs. This issue carries CVSS 6.5 (AV:N/AC:L/PR:N/UI:N); no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Remote code execution and denial of service in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 stem from improper input validation (CWE-444 HTTP Request Smuggling). Unauthenticated network attackers can send crafted requests that desynchronize the plug-in's request parsing, potentially achieving full compromise of the application tier. No public exploit identified at time of analysis, and EPSS remains low (0.06%), but the vendor confirms a patch and CISA SSVC rates the technical impact as total with automatable exploitation.

HTTP request smuggling in IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5 and 9.0 allows remote unauthenticated attackers to send specially crafted requests that desynchronize front-end and back-end HTTP parsing. Successful exploitation enables cache poisoning, security control bypass, and limited disclosure or modification of data passing through the plug-in, with a CVSS 7.5 reflecting a Changed scope and high confidentiality impact. There is no public exploit identified at time of analysis, EPSS is low at 0.05% (15th percentile), and CISA SSVC marks exploitation status as none.

HTTP request smuggling in Netty's HTTP codec (netty-codec-http) lets an unauthenticated remote attacker inject a second request when a malformed 'Transfer-Encoding: chunked, identity' header is forwarded by an upstream proxy that uses Content-Length instead of rejecting it. Affected releases are netty-codec-http 4.2.0.Alpha1 through 4.2.12.Final and versions up to 4.1.132.Final; standalone Netty or deployments behind a strict RFC 9112 proxy are not practically exploitable for smuggling. Exploitation is not confirmed in CISA KEV, EPSS is low (0.03%, 8th percentile), and the advisory contains a public PoC reference; it is not verified as working exploit code.

HTTP response desynchronization in Netty's HttpClientCodec (netty-codec-http 4.1.x through 4.1.132.Final and 4.2.0.Alpha1 through 4.2.12.Final) lets a malicious or misbehaving server cause one request's response body to be parsed as another's. Because the codec polls its request queue once per inbound response — including for informational 1xx — a pipelined GET+HEAD sequence preceded by a 103 mispairs the HEAD with the GET's 200, leaving GET entity bytes on the wire so the following response is parsed from the wrong offset. Rated CVSS 9.1 (I:H/A:H), publicly available exploit code exists (a vendor PoC ships in the advisory), though EPSS is very low (0.04%) and it is not on CISA KEV.

HTTP request smuggling in Netty's netty-codec-http (HttpObjectDecoder) lets remote attackers desynchronize message boundaries by sending an HTTP/1.0 request carrying both Transfer-Encoding: chunked and Content-Length. Netty's anti-smuggling sanitization that strips the conflicting Content-Length header only runs for HTTP/1.1, so on HTTP/1.0 Netty parses the body as chunked while leaving Content-Length intact for any downstream Content-Length-first proxy, which then treats trailing chunk bytes as a new request. Publicly available exploit code exists (a working EmbeddedChannel PoC test), but EPSS is very low (0.03%, 8th percentile) and it is not in CISA KEV.

HTTP Request Smuggling in Gazelle (Perl web server) versions through 0.49 enables attackers to smuggle malicious requests through reverse proxies by exploiting incorrect header precedence. Gazelle violates RFC 7230 by prioritizing Content-Length over Transfer-Encoding: chunked when both headers are present, allowing desynchronization between front-end proxies and the backend server. SSVC framework indicates the vulnerability is automatable with partial technical impact, while CVSS 7.5 reflects network-accessible unauthenticated exploitation with high integrity impact. A vendor patch is available via CPANSec.

HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.

HTTP request smuggling in Apache Pony Mail (Lua implementation) enables remote unauthenticated attackers to achieve complete admin account takeover with critical impact across confidentiality, integrity, and availability. This affects all versions of the retired Lua codebase - Apache has abandoned support with no patch planned, recommending migration to alternative solutions. CVSS 9.8 critical severity reflects trivial network-based exploitation requiring no authentication or user interaction.

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/back-end request boundaries by abusing quoted-string chunk extensions. Jetty incorrectly terminates chunk-extension parsing at a CRLF located inside an unterminated quoted-string (e.g. `1;a="`) rather than rejecting it, so attacker-controlled bytes are reinterpreted as a second, smuggled request on the same TCP connection. Publicly available exploit code exists (a working Python PoC ships in the GHSA advisory), though EPSS is very low (0.03%, 9th percentile) and the issue is not on CISA KEV.

HTTP request smuggling in Apache Tomcat 7.x through 11.x permits unauthenticated remote attackers to manipulate request routing and bypass security controls via malformed chunk extension processing. Exploitation enables header injection, cache poisoning, and request routing manipulation without code execution. Affects Tomcat 7.0.0-7.0.109, 8.5.0-8.5.100, 9.0.0.M1-9.0.115, 10.1.0-M1-10.1.52, and 11.0.0-M1-11.0.18. No public exploit identified at time of analysis. Low observed exploitation activity (EPSS 0.02%).

HTTP request smuggling and denial of service in Tinyproxy through 1.11.3 allows unauthenticated remote attackers to cause backend worker exhaustion and bypass request inspection controls. The vulnerability stems from case-sensitive Transfer-Encoding header parsing that violates RFC 7230, enabling attackers to send 'Transfer-Encoding: Chunked' (capitalized) to desynchronize Tinyproxy's request state from RFC-compliant backends like Node.js and Nginx. No public exploit identified at time of analysis, though EPSS data not available and technical details are publicly documented in GitHub issue #604. Authentication requirements not confirmed from available data, but CVSS vector indicates network-accessible attack requiring no privileges.

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.

CVE-2026-33870 is a security vulnerability (CVSS 7.5). High severity vulnerability requiring prompt remediation.

A critical HTTP Request Smuggling vulnerability exists in Erlang OTP's inets httpd module that allows attackers to desynchronize front-end and back-end servers by exploiting inconsistent Content-Length header parsing. The vulnerability affects Erlang OTP versions from 17.0 through 28.4.0 (inets 5.10 through 9.6.0) and enables attackers to bypass security controls, potentially poisoning web caches or accessing unauthorized resources. While not currently listed in CISA KEV or showing high EPSS scores, the vulnerability has a CVSS 4.0 score of 7.0 and could lead to significant security boundary violations in production environments using affected Erlang-based web services.

HTTP request smuggling in H3 framework versions before 1.15.5 allows remote attackers to bypass security controls by exploiting improper case-sensitive validation of the Transfer-Encoding header. The vulnerability enables attackers to inject malicious requests that diverge between client and server parsing, potentially leading to cache poisoning, session hijacking, or other attacks. Public exploit code exists for this vulnerability.

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier,. Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

HTTP request smuggling in OpenWrt's uhttpd affects unpatched repository snapshots that predate the upstream fixes, allowing an unauthenticated remote attacker who controls raw request framing over a keep-alive connection to send a mixed-case Transfer-Encoding token such as 'Chunked' and have the chunked POST body left unread, so leftover bytes are parsed as a follow-on request. The result is boundary desynchronization with integrity impact rather than direct confidentiality or availability loss; default deployments that accept POST bodies over persistent connections are in scope. No CISA KEV listing or confirmed working exploit code is identified in the supplied data, although the upstream advisory includes reproduction steps; the supplied CVSS 4.0 score is 6.9 and the assessed CVSS 3.1 base is 5.3, aligning with a this-month priority.

HTTP request smuggling in OpenWrt's uhttpd allows a remote attacker to desynchronize request boundaries on a keep-alive connection by delivering the JSON body of a POST /ubus across multiple TCP segments, so the unread body suffix is parsed as a brand-new request and the server emits two responses for one exchange (a JSON-RPC parse error followed by the smuggled request's response). The defect is in the application-layer body handler uh_ubus_data_send() in ubus.c and affects unpatched repository snapshots; the /ubus endpoint is enabled in the default OpenWrt configuration, and the impact matters most where uhttpd is deployed behind a reverse proxy or CDN that reuses backend connections. Reported severity is CVSS 4.0 6.9 (the independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, integrity-only with a scope change), the reporter described a Python PoC script but it is not verified as working, generally available exploit code, there is no CISA KEV entry, and the issue is fixed in upstream repository commits rather than a confirmed tagged release.

HTTP request smuggling in OpenWrt uhttpd allows remote attackers to have attacker-supplied body bytes parsed as a second request on the same keep-alive connection when an invalid chunk-length line, such as a value exceeding INT_MAX, causes client_poll_post_data() to reset content_length and transfer_chunked without draining the body or closing the connection. Affected are unpatched uhttpd repository snapshots and builds predating fix commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690. The assessed vector is AV:N/AC:H/PR:N/UI:N with low confidentiality and integrity impact; exploitation is constrained by the need to align the embedded request and by typical LAN-only exposure, and there is no CISA KEV entry or confirmed working exploit, although the public advisory provides reproduction steps.

Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the application returns for a HEAD request is sent. With Plack::Middleware::Head the body is empty, but an HTTP/1.1 response without a Content-Length header still gets the chunked encoding terminator. Responses with status 204 or 304 are also sent with their body. Pipelined GET and HEAD requests keep the connection open even when keep-alive is disabled, which is the default. A client or proxy reading the connection takes the extra bytes as the start of the next response, which may desynchronize a proxy that shares the connection across clients.

Request smuggling in Undertow's ChunkReader lets a remote attacker bypass the chunk-size limit using a crafted 15-digit chunk length, overflow internal state flags, and force the server to end a request body early so the trailing bytes are reinterpreted as a second, smuggled request. Red Hat ships the affected Undertow code in JBoss Enterprise Application Platform 7 and 8, Fuse 7, Red Hat Single Sign-On 7, the Red Hat build of Apache Camel for Spring Boot 4, and Red Hat Enterprise Linux 8 and 9, scored CVSS 3.1 6.5 with low integrity and availability impact and no confidentiality impact. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; real-world consequence is concentrated in deployments where Undertow shares connections with, or sits behind, a front-end proxy or load balancer whose parser disagrees on message boundaries, while standalone deployments without connection reuse are largely limited to premature termination of the attacker's own request.

Hop-by-hop header leakage in Caddy's reverse proxy during WebSocket upgrades allows an upstream that emits headers such as Set-Cookie, Alt-Svc, Keep-Alive or Proxy-Authenticate to have them relayed unmodified to clients instead of being stripped as RFC 7230 §6.1 requires. Caddy v2 releases up to and including 2.11.4 are affected when configured with reverse_proxy and handling HTTP 101 Switching Protocols; the assessed vector (AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:H/A:N) reflects that the attacker must control or compromise the upstream response and that a victim must actually open the WebSocket, with high integrity impact and limited confidentiality impact. A public proof-of-concept reproduction script is included in the GHSA advisory, no KEV entry or EPSS score was provided, and the vuln.today decision label is 'monitor'.

Inconsistent HTTP response framing in CPython's http.client allows a malformed Content-Length header or chunked chunk-size field - for example '+5', '5_0', '0x5', '1_f', '-5' or a leading-space value - to be accepted by Python's permissive int() parsing while a strict RFC 9112 peer rejects or frames it differently, so an application can misinterpret HTTP response contents. The exposure is limited to deployments where CPython below 3.16.0 parses responses that also traverse a strict intermediary such as a proxy or cache, and to applications that pass attacker-influenced responses into http.client (directly or via libraries built on it); the vendor's CVSS 4.0 score is 2.0 with only low integrity impact on the subsequent system and no confidentiality or availability effect, and the independent assessment likewise treats it as low priority. No public exploit code has been identified at time of analysis and there is no CISA KEV entry; the issue is rated 'monitor' in the vuln.today priority scheme.

HTTP request smuggling in the Elixir Bandit web server (1.12.4 up to but not including 1.14.0) lets an unauthenticated remote attacker slip a second request past a front-end proxy by embedding a bare LF in a chunk extension. Because Bandit's HTTP/1.1 chunked reader treats the chunk-size line as everything up to the first CRLF and discards anything after ';' without validating it against the RFC 9112 chunk-ext grammar, Bandit can end a body early and dispatch a trailing 'GET /admin' as its own pipelined request, while a proxy that terminates the size line at the bare LF forwards the same bytes as a single POST. Impact is bounded by a hard precondition: there must be a front-end proxy that treats a bare LF as a line ending and forwards chunked bodies unchanged (the AT:P requirement, outside attacker control) - deployments without such a proxy are not affected. Severity is medium (CVSS 4.0 base 6.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N), no CISA KEV entry exists, and the vendor advisory describes a proof-of-concept procedure that is not confirmed as publicly available working exploit code.

Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. For a HEAD request Starman omits chunked framing but still writes the body returned by the application, on both the array and streaming response paths. Responses with a 1xx, 204 or 304 status also carry the body. On a keep-alive or pipelined connection the client reads those bytes as the start of the next response. A front-end proxy that reuses upstream connections may then pair responses with the wrong requests.