CVE-2026-77803: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in Progress Software Progress® Telerik® Fiddler® Classic

Progress Telerik Fiddler Classic for Windows versions before 6.0.20262.10021 contain an HTTP request/response smuggling vulnerability (CWE-444). The proxy component forwards HTTP requests that include both Content-Length and Transfer-Encoding headers without removing one, but internally frames the body using only Transfer-Encoding. This discrepancy causes desynchronization on reused client connections, allowing a local attacker with low privileges to craft a malformed request that is split into two separate requests forwarded to the origin server. The attacker can then receive an additional smuggled response. This vulnerability does not require the origin server to be vulnerable.

An attacker with local low privileges can exploit this vulnerability to cause request desynchronization in the proxy, leading to the forwarding of two requests from a single malformed request and receiving an additional smuggled response. The confidentiality and integrity of data may be partially impacted (low impact), but there is no impact on availability. The CVSS 3.1 base score is 3.6 (low severity) reflecting limited impact and the requirement for local access with high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running vulnerable versions of Progress Telerik Fiddler Classic or restrict local access to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.