warp · HTTP Request Smuggling
Affects warpSource GCVE Database
Rated High by Threat Radar's AI analysis
- Patch
- Available – fixed in 3.4.17
Data as of 4 Nov 2026, 13:15 UTC
What to do
Upgrade warp to 3.4.17.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagewarp | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to warp version 3.4.17 or later, which includes fixes that validate HTTP request framing and reject ambiguous or malformed requests. The update raises specific exceptions for invalid requests, resulting in 400 or 501 HTTP responses. No other mitigation is required as the fix addresses the root cause.
Description
Warp versions from 1.3.3 up to but not including 3.4.17 contain multiple HTTP/1.x request parsing flaws that allow HTTP request smuggling. These flaws cause warp to interpret request framing differently than front-end proxies, enabling attackers to bypass access controls, request validation, logging, or WAF rules. The HTTP/2 support is unaffected. Warp 3.4.17 fixes these issues by validating request framing and rejecting ambiguous or malformed requests with appropriate errors.