CVE-2026-93574 is a moderate severity vulnerability in Netty's netty-codec-http component used by Red Hat AMQ Broker 7. It involves incorrect parsing of HTTP/1.1 chunk-size tokens that include post-digit whitespace, leading to HTTP request smuggling. This flaw can allow attackers to bypass security controls or access unauthorized resources in proxy or backend deployments.
CVE-2026-11722 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server versions 8.5 and 9.0, as well as IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.5. This vulnerability could allow an attacker to interfere with the processing of HTTP requests, potentially leading to limited confidentiality and integrity impacts. The vulnerability has a medium severity rating with a CVSS score of 4.8.
IBM WebSphere Application Server version 8.5 is affected by an HTTP request smuggling vulnerability caused by improper handling of Content-Length headers. This vulnerability can allow an attacker to interfere with the processing of HTTP requests, potentially leading to high confidentiality impact and limited integrity impact. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
CVE-2026-11548 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server versions 8.5, 9.0, and IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.5. This vulnerability allows an attacker to interfere with the processing of HTTP requests, potentially leading to information disclosure and integrity impacts. The CVSS score is 4.8 (medium severity), indicating a moderate risk. No public exploits or known active exploitation have been reported. Patch status is not confirmed as no patch links or vendor advisories are provided.
CVE-2026-10841 is a medium severity vulnerability in IBM WebSphere Application Server versions 8.5, 9.0, Liberty 17.0.0.3 through 26.0.0.5, and version 10.1. It involves inconsistent interpretation of HTTP requests, known as HTTP request/response smuggling (CWE-444). This flaw could allow an attacker to manipulate HTTP request processing, potentially impacting confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 4.8, indicating a moderate risk. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
CVE-2026-93569 is a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process affecting certain versions of Red Hat Build of Apache Camel. The flaw occurs when an HTTP/1 request contains both an absolute-form request-target and a conflicting Host header; Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This can lead to unauthorized access, cache poisoning, or misrouting of requests in Netty-based proxies or gateways. A security update addressing this and other vulnerabilities is available in Red Hat build of Quarkus 3.33.3.SP2.
CVE-2026-93573 is a medium severity vulnerability in Netty's HTTP/1.1 decoder used by Red Hat build of Quarkus 3.27.5.SP2. It allows remote attackers to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding such as gzip or deflate. This enables HTTP request smuggling, which can lead to bypassing security controls and desynchronizing request processing. Red Hat has released an important security update in Quarkus 3.33.3.SP2 that addresses this vulnerability along with others.
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive connection buffer. A remote unauthenticated client can place attacker-controlled bytes in that trailer region, causing Sanic to parse and route them as a hidden second request after the outer request. This breaks HTTP request-boundary integrity and can provide a request-smuggling primitive when Sanic is deployed behind intermediaries. This issue is fixed in version 25.12.1.
IBM WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.5 are affected by an HTTP request smuggling vulnerability. This issue arises from improper parsing of the HTTP transfer-encoding request header. Exploitation could allow attackers to poison web caches, bypass web application firewalls, and conduct cross-site scripting (XSS) attacks. The vulnerability has a medium severity with a CVSS score of 6.5.
IBM WebSphere Application Server versions 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.5 are affected by an HTTP request smuggling vulnerability due to improper parsing of the HTTP transfer-encoding header. This flaw allows attackers to craft malicious HTTP requests that can poison web caches, bypass web application firewalls, and enable cross-site scripting (XSS) attacks. The vulnerability has a medium severity rating with a CVSS score of 6.5.
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and from 1.0.0-M1 until 1.0.0-M42, five HTTP/1.1 conformance laxities in the hand-written Java parser under http/src/main/java/org/http4s/blaze/http/parser/ can cause blaze to derive a different request boundary than a stricter fronting intermediary. A default BlazeServerBuilder accepts invalid or valueless header field names that violate tchar syntax, obsolete folded field lines (obs-fold), unsupported Transfer-Encoding values, duplicate Content-Length fields, and requests containing both Transfer-Encoding and Content-Length. If a lenient or legacy proxy forwards the malformed bytes but interprets them differently, the disagreement can permit front-end authorization bypass, response-queue poisoning on pooled backend connections, or cache poisoning. Exploitation requires a pair of disagreeing parsers; no non-default blaze configuration is required. The affected checks are enforced in BodyAndHeaderParser and Http1ServerParser. This issue is fixed in versions 0.23.18 and 1.0.0-M42.
CVE-2026-81356 is a high-severity vulnerability in Microsoft Visual Studio Code involving HTTP request smuggling due to inconsistent interpretation of HTTP requests. This flaw allows an unauthorized attacker to bypass a security feature over a network. The vulnerability affects versions from 1.0.0 up to but not including 1.136.2. An official fix is available in version 1.136.2.
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.
This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
### Summary
HTTPX2 can automatically add a `Content-Length` header to a request that already contains a caller-supplied `Transfer-Encoding` header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection desynchronization when processed by intermediaries that disagree about which header takes precedence.
### Details
When a request body has a known size, HTTPX2's content encoder returns a default `Content-Length`. `Request._prepare()` applies each default header with `setdefault()`, which only checks whether that same header is already present. It does not check whether the mutually exclusive `Transfer-Encoding` header is present.
For example:
```python
import httpx2
request = httpx2.Request(
"POST",
"http://example.com/",
headers={"Transfer-Encoding": "chunked"},
content=b"test 123",
)
print(request.headers)
```
The request contains both:
```text
Transfer-Encoding: chunked
Content-Length: 8
```
On an HTTP/1.1 connection, the body is serialized using chunked transfer coding while both headers are sent on the wire. This violates HTTP message-framing requirements. Fixed-size byte, JSON, form, and known-length multipart bodies can reach the affected path.
Streaming bodies with an explicit `Content-Length` are not affected in current HTTPX2 releases because the automatically generated `Transfer-Encoding` is already suppressed in that direction.
### Impact
An attacker may be able to use the conflicting framing headers as a request-smuggling or desynchronization primitive. Exploitation requires an application to pass attacker-controlled request framing headers and associated body data to HTTPX2, use HTTP/1.1, and communicate through a proxy or origin that accepts conflicting headers and interprets them differently from another hop.
Depending on the downstream infrastructure, successful exploitation could interfere with requests sharing a persistent connection, bypass front-end routing or authorization decisions, or poison responses or caches. Applications that do not forward attacker-controlled `Transfer-Encoding` headers are not directly exposed.
### Mitigation
Upgrade to HTTPX2 `2.11.0` or later. Patched versions treat `Content-Length` and `Transfer-Encoding` as mutually exclusive when applying automatically generated request headers.
If upgrading is not immediately possible, remove `Transfer-Encoding` and other hop-by-hop framing headers from untrusted input before constructing outbound requests. Applications acting as proxies should derive outbound framing from the body rather than forwarding inbound `Content-Length` or `Transfer-Encoding` headers.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5.
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment configurations, a network attacker could obtain confidential responses intended for other authenticated users.
CVE-2026-73812 is a high-severity vulnerability in Erlang OTP's HTTP server (httpd) involving inconsistent interpretation of HTTP requests, specifically HTTP request/response smuggling. The vulnerability occurs because the httpd function check_header/3 rejects duplicate Content-Length headers but does not check for the simultaneous presence of Transfer-Encoding and Content-Length headers, which RFC 9112 §6.3 identifies as a probable smuggling attempt. This can lead to desynchronization between front-end and back-end HTTP processing when a Content-Length-preferring front-end is paired with a chunked-preferring back-end. Multiple OTP and inets versions are affected. No explicit patch information is provided.
CVE-2026-73276 is a high-severity vulnerability in Erlang OTP that involves inconsistent interpretation of HTTP requests, specifically in the Gracefulness code. This flaw allows HTTP Request Smuggling attacks by ignoring certain cases that should have been rejected. The vulnerability affects multiple OTP versions from 22.2 up to but not including 27.3.4.17, 28.0 up to but not including 28.5.0.6, and 29.0 up to but not including 29.0.6, as well as corresponding inets versions. It has a CVSS 4.0 score of 8.3, indicating high severity. No vendor advisory or patch information is currently available.
CVE-2026-66357 is a high-severity vulnerability in Erlang OTP's httpd component related to inconsistent interpretation of HTTP requests, specifically HTTP request/response smuggling. The issue arises because httpd never implemented obs-fold (header continuation lines) as specified in RFC 2616 and RFC 7230, causing every CRLF followed by a non-CRLF octet to start a new header unconditionally. This behavior can lead to security concerns as it deviates from expected HTTP parsing, potentially enabling request smuggling attacks. The vulnerability affects multiple OTP and inets versions prior to specific fixed releases.