CVE-2026-40562 is an HTTP request smuggling vulnerability in KAZEBURO's Gazelle (versions through 0.49 for Perl). The issue arises because Gazelle improperly prioritizes the Content-Length header over the Transfer-Encoding: chunked header when both are present in an HTTP request. According to RFC 7230 section 3.3.3, Transfer-Encoding must take precedence. This inconsistency can be exploited by attackers to smuggle malicious HTTP requests through front-end reverse proxies, potentially impacting the integrity of HTTP request processing.

The vulnerability allows an attacker to perform HTTP request smuggling by exploiting the incorrect header precedence in Gazelle. This can lead to injection of malicious HTTP requests that bypass security controls implemented by front-end reverse proxies. The CVSS score of 7.5 indicates a high impact on integrity without affecting confidentiality or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, users should monitor vendor communications for updates. Until a fix is available, consider deploying additional protections at the reverse proxy or web application firewall level to detect and block malformed HTTP requests that contain conflicting Content-Length and Transfer-Encoding headers.