A HTTP request smuggling and desynchronization vulnerability affects Kong Gateway Enterprise 3.4, 3.10, 3.11, 3.12, 3.13, and 3.14 series. The vulnerability is caused by a parsing flaw in Kong’s HTTP request processing pipeline when handling untrusted HTTP/1.1 traffic.
Spring Framework versions 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7 are vulnerable to HTTP request smuggling attacks via multipart requests. This vulnerability is identified as CWE-444, involving inconsistent interpretation of HTTP requests. The CVSS score is 5.3, indicating a medium severity level. No official patch or remediation guidance has been provided yet.
CVE-2026-44546 is a low-severity vulnerability in djangoproject's daphne server version 4.2.0. It arises from inconsistent parsing of HTTP headers between Twisted and autobahn libraries during WebSocket handshake processing. Specifically, certain control characters are not treated as header separators by Twisted but are split by autobahn, allowing an attacker to inject additional headers into the ASGI scope. This can lead to HTTP request smuggling. The issue is fixed in daphne versions after 4.2.0, where requests containing these bytes in header values are rejected with a 400 response.
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync
attack (request smuggling), which in turn can be used for cache poisoning,
authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the
feature parameter to contain +http2. HTTP/2 support is disabled by
default.
CVE-2026-49753 is a medium-severity vulnerability in the elixir-mint Mint HTTP client library affecting version 0.1.0. It involves inconsistent interpretation of HTTP/1 Content-Length headers, specifically allowing signed values like '+0' which are invalid per RFC 7230. This discrepancy can lead to HTTP request/response smuggling when Mint reuses connections, potentially causing response desynchronization and data leakage between different consumers sharing the same connection.
cpp-httplib versions prior to 0.44.0 have a vulnerability where the server applies percent-decoding to every HTTP header value except Location and Referer, leading to improper neutralization of CRLF sequences and inconsistent interpretation of HTTP requests. This issue is tracked as CVE-2026-45372 and has a high CVSS score of 9.9. The vulnerability is addressed in cpp-httplib-devel-0.46.1-1.1 and other patched versions.
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, app.mount() strips the mount prefix from the incoming request path using the raw URL pathname, while route matching is performed against the percent-decoded path. This inconsistency causes the prefix to be stripped at the wrong position when the path contains percent-encoded multi-byte characters, resulting in the mounted sub-application receiving an incorrect path. This vulnerability is fixed in 4.12.21.
Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.
CVE-2026-8620 is a high-severity vulnerability affecting IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty versions 8.5 and 9.0. It involves HTTP request smuggling due to inconsistent interpretation of HTTP requests by the Web Server Plug-ins when processing specially crafted requests. The vulnerability can lead to high confidentiality impact and limited integrity impact but does not affect availability. No official patch or remediation guidance has been provided yet, and no known exploits are reported in the wild.
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain a vulnerability where malformed Transfer-Encoding headers are incorrectly parsed, allowing HTTP request/response smuggling attacks. This flaw has been addressed in versions 4.2.13.Final and 4.1.133.Final.
CVE-2026-42584 is a vulnerability in Netty's HttpClientCodec where certain sequences of HTTP responses cause incorrect pairing of responses to requests. This leads to subsequent HTTP responses being parsed from incorrect offsets, potentially causing information disclosure or data integrity issues. The flaw is fixed in Netty versions 4.2.13.Final and 4.1.133.Final.
CVE-2026-42580 is a medium severity vulnerability in Netty, an asynchronous network application framework. The issue involves an integer overflow in the chunk size parser prior to versions 4.2.13.Final and 4.1.133.Final, which enables HTTP request/response smuggling attacks. This vulnerability has been fixed in the specified versions.
CVE-2026-39825 is a medium severity vulnerability in the Go standard library's net/http/httputil ReverseProxy component. It involves inconsistent parsing of HTTP query parameters, where some parameters may be hidden from certain functions like Rewrite or Director but still forwarded by ReverseProxy. This leads to inconsistent interpretation of HTTP requests, classified as HTTP Request/Response Smuggling (CWE-444). No official patch or remediation guidance has been published, and no known exploits exist in the wild.
Netty versions up to 4.2.12.Final and 4.1.132.Final contain a CRLF injection vulnerability due to insufficient validation in the setUri() method of DefaultHttpRequest and DefaultFullHttpRequest. This allows an attacker to inject CRLF characters into the HTTP or RTSP request line, potentially enabling HTTP request smuggling, desynchronization, or RTSP request injection. The issue is fixed in versions 4.2.13.Final and 4.1.133.Final.
Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Starlet versions through 0.31 for Perl allows HTTP Request Smuggling via Improper Header Precedence.
Starlet incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence.
An attacker could exploit this to smuggle malicious HTTP requests via a front-end reverse proxy.
Inconsistent Interpretation of HTTP Requests vulnerability in mtrudel bandit allows HTTP request smuggling via duplicate Content-Length headers.
'Elixir.Bandit.Headers':get_content_length/1 in lib/bandit/headers.ex uses List.keyfind/3, which returns only the first matching header. When a request contains two Content-Length headers with different values, Bandit silently accepts it, uses the first value to read the body, and dispatches the remaining bytes as a second pipelined request on the same keep-alive connection. RFC 9112 §6.3 requires recipients to treat this as an unrecoverable framing error.
When Bandit sits behind a proxy that picks the last Content-Length value and forwards the request rather than rejecting it, an unauthenticated attacker can smuggle requests past edge WAF rules, path-based ACLs, rate limiting, and audit logging.
This issue affects bandit: before 1.11.0.
CVE-2026-40560 is a high-severity vulnerability in MIYAGAWA Starman versions before 0.4018 for Perl. The issue arises because Starman incorrectly prioritizes the Content-Length header over the Transfer-Encoding: chunked header when both are present in an HTTP request, contrary to RFC 7230 section 3.3.3. This improper header precedence enables HTTP Request Smuggling attacks, where an attacker can send crafted requests that are interpreted inconsistently by front-end reverse proxies and the backend server. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time. The vulnerability affects network-exposed services and has a CVSS score of 7.5, indicating high severity.
** UNSUPPORTED WHEN ASSIGNED ** Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Pony Mail leading to admin account takeover.
This issue affects all versions of the Lua implementation of Pony Mail. There is a Python implementation under development under the name "Pony Mail Foal" that is not affected by this issue, but hasn't been released yet.
As the Lua implementation of this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.