CVE-2024-42342
4.3MEDIUM
Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
9/8/2024CWE-444
Tipo de Fraqueza
CWE-444
Todas as vulnerabilidades CVE classificadas sob este tipo de fraqueza.
Ver no MITRE CWETotal CVEs
50
Críticos
8
No KEV
0
Com Exploits
0
CVE-2023-52354
7.5HIGH
chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.
chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.
1/22/2024CWE-444, CWE-444
CVE-2025-6999
NONE
An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cro
An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote attacker to evade request parameter sanitation and perform a reflected self-Cro...
9/15/2025CWE-444
CVE-2022-2466
9.8CRITICAL
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
It was found that Quarkus 2.10.x does not terminate HTTP requests header context which may lead to unpredictable behavior.
8/31/2022CWE-444, CWE-444
CVE-2023-33934
9.1CRITICAL
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
8/9/2023CWE-444, CWE-444
CVE-2022-38114
6.1MEDIUM
This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.
This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.
11/23/2022CWE-79, CWE-444 +2
CVE-2023-30910
5.4MEDIUM
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.
10/9/2023CWE-444, CWE-444
CVE-2024-22279
5.9MEDIUM
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scal
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scal...
6/10/2024CWE-444, CWE-444
CVE-2020-5207
5.4MEDIUM
In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.
In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.
1/27/2020CWE-444, CWE-444
CVE-2021-22960
6.5MEDIUM
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
The parse function in llhttp < 2.1.4 and < 6.0.6. ignores chunk extensions when parsing the body of chunked requests. This leads to HTTP Request Smuggling (HRS) under certain conditions.
11/3/2021CWE-444, CWE-444
CVE-2021-41732
7.5HIGH
An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the obser
An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the obser...
9/29/2021CWE-444, CWE-444
CVE-2017-12165
2.6LOW
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
7/27/2018CWE-444, CWE-444
CVE-2022-25763
7.5HIGH
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0
Improper Input Validation vulnerability in HTTP/2 request validation of Apache Traffic Server allows an attacker to create smuggle or cache poison attacks. This issue affects Apache Traffic Server 8.0...
8/10/2022CWE-444, CWE-444
CVE-2021-22959
6.5MEDIUM
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
The parser in accepts requests with a space (SP) right after the header name before the colon. This can lead to HTTP Request Smuggling (HRS) in llhttp < v2.1.4 and < v6.0.6.
11/15/2021CWE-444, CWE-444
CVE-2024-32638
6.3MEDIUM
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are ...
5/2/2024CWE-444, CWE-444
CVE-2022-36760
9.0CRITICAL
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reques
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reques...
1/17/2023CWE-444, CWE-444
CVE-2022-0552
5.9MEDIUM
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-ht
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-ht...
4/11/2022CWE-444, CWE-444
CVE-2022-42252
7.5HIGH
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default fo
If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default fo...
11/1/2022CWE-444, CWE-444 +1
CVE-2021-37147
7.5HIGH
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.
11/3/2021CWE-20, CWE-444 +2
CVE-2023-25950
7.3HIGH
HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive
HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate user's request. As a result, the attacker may obtain sensitive...
4/11/2023CWE-444, CWE-444
CVE-2022-35256
6.5MEDIUM
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
12/5/2022CWE-444, CWE-444
CVE-2022-26377
7.5HIGH
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reques
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards reques...
6/9/2022CWE-444, CWE-444
CVE-2020-11076
7.5HIGH
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
In Puma (RubyGem) before 4.3.4 and 3.12.5, an attacker could smuggle an HTTP response, by using an invalid transfer-encoding header. The problem has been fixed in Puma 3.12.5 and Puma 4.3.4.
5/22/2020CWE-444, CWE-444
CVE-2021-25762
5.3MEDIUM
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
In JetBrains Ktor before 1.4.3, HTTP Request Smuggling was possible.
2/3/2021CWE-444
CVE-2020-26129
6.5MEDIUM
In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.
11/16/2020CWE-444
CVE-2025-29904
5.3MEDIUM
In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible
3/12/2025CWE-444
CVE-2023-51701
5.3MEDIUM
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an
fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. A reverse proxy server built with `@fastify/reply-from` could misinterpret the incoming body by passing an...
1/8/2024CWE-444, CWE-444
CVE-2022-32214
6.5MEDIUM
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS).
7/14/2022CWE-444, CWE-444
CVE-2021-32565
7.5HIGH
Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0
Invalid values in the Content-Length header sent to Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0...
6/29/2021CWE-444, CWE-444
CVE-2021-27577
7.5HIGH
Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0
Incorrect handling of url fragment vulnerability of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0...
6/29/2021CWE-444, CWE-444
CVE-2025-41235
8.6HIGH
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies.
5/30/2025CWE-444
CVE-2021-31923
5.3MEDIUM
Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.
Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.
9/24/2021CWE-444
CVE-2023-27238
9.8CRITICAL
LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
5/12/2023CWE-444
CVE-2018-21245
9.1CRITICAL
Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.
Pound before 2.8 allows HTTP request smuggling, a related issue to CVE-2016-10711.
6/15/2020CWE-444
CVE-2023-23691
8.1HIGH
Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browse
Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability. An unauthenticated attacker could potentially exploit this vulnerability to force a victim's browse...
1/20/2023CWE-444, CWE-444
CVE-2022-45059
7.5HIGH
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-b
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-b...
11/9/2022CWE-444, CWE-444
CVE-2019-1020012
7.5HIGH
parse-server before 3.4.1 allows DoS after any POST to a volatile class.
parse-server before 3.4.1 allows DoS after any POST to a volatile class.
7/29/2019CWE-444
CVE-2024-27185
9.1CRITICAL
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors.
8/20/2024CWE-444
CVE-2024-8925
3.1LOW
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being proces
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being proces...
10/8/2024CWE-444, CWE-444
CVE-2023-38522
7.5HIGH
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache
Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to origin servers. This can be utilized for request smuggling and may also lead cache...
7/26/2024CWE-444, CWE-444
CVE-2023-46137
5.3MEDIUM
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously ...
10/25/2023CWE-444, CWE-444
CVE-2022-32215
6.5MEDIUM
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smuggling (HRS).
7/14/2022CWE-444, CWE-444
CVE-2022-32213
6.5MEDIUM
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
7/14/2022CWE-444, CWE-444
CVE-2020-8201
7.4HIGH
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions,
Node.js < 12.18.4 and < 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, ...
9/18/2020CWE-444, CWE-444
CVE-2024-35161
7.5HIGH
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerab
Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may also lead cache poisoning if the origin servers are vulnerab...
7/26/2024CWE-444, CWE-444
CVE-2020-8287
6.5MEDIUM
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the
Node.js versions before 10.23.1, 12.20.1, 14.15.4, 15.5.1 allow two copies of a header field in an HTTP request (for example, two Transfer-Encoding header fields). In this case, Node.js identifies the...
1/6/2021CWE-444, CWE-444
CVE-2024-44775
7.5HIGH
An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service(DoS) via a crafted request.
An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service(DoS) via a crafted request.
10/15/2024CWE-444
CVE-2024-34535
5.9MEDIUM
In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.
In Mastodon 4.1.6, API endpoint rate limiting can be bypassed by setting a crafted HTTP request header.
10/3/2024CWE-444
CVE-2016-10711
9.8CRITICAL
Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751.
1/29/2018CWE-444
CVE-2024-29643
9.1CRITICAL
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
4/18/2025CWE-444
Mostrando 50 de many CVEs