CVE-2026-77802: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Progress Software Progress® Telerik® Fiddler® Classic

Progress® Telerik® Fiddler® Classic versions before 6.0.20262.10021 contain an HTTP request smuggling vulnerability (CWE-444) in the proxy request forwarding component. The issue occurs when requests with multiple conflicting Content-Length headers are forwarded verbatim to the origin server, but Fiddler uses only the first Content-Length header to frame the request body. A local attacker with low privileges who sends requests through the same Fiddler proxy instance as another user can exploit this desynchronization against origin servers that do not comply with RFC-9110 and keep connections alive. This allows the attacker to smuggle additional requests, causing the server to buffer unread smuggled responses on the socket. These responses can then be served to other users reusing the connection, enabling response poisoning and unauthorized access to other users' responses.

The vulnerability allows a local low-privilege attacker to perform HTTP request smuggling via the Fiddler proxy, potentially poisoning responses delivered to other users and accessing responses intended for them. This can lead to confidentiality breaches and integrity issues in the affected environment. The CVSS 3.1 base score is 6.3 (medium severity), reflecting high impact on confidentiality and integrity but requiring local access and high attack complexity.

A fixed version of Progress® Telerik® Fiddler® Classic is available starting from version 6.0.20262.10021. Users should upgrade to this version or later to remediate the vulnerability. No other mitigation or temporary workaround is indicated in the provided data. Patch status is confirmed by the affectedVersions field indicating versions prior to 6.0.20262.10021 are vulnerable.