Threat Intelligence Database

CVE-2026-77804 is a time-of-check time-of-use (TOCTOU) race condition vulnerability in Progress® Telerik® Fiddler® Classic for Windows versions before 6.0.20262.10021. It occurs during the installation of the HTTPS interception root certificate into the Local Computer certificate store. An attacker with low privileges can replace a temporary certificate file before it is imported by an elevated helper process, potentially installing a malicious root certificate. Exploitation requires user initiation and approval of an elevation prompt.

CVE-2026-77803 is a low-severity HTTP request/response smuggling vulnerability in Progress Telerik Fiddler Classic for Windows versions prior to 6.0.20262.10021. The issue arises because the proxy forwards requests containing both Content-Length and Transfer-Encoding headers with both headers present, but frames the body using Transfer-Encoding only. This causes the remaining bytes on a reused client connection to be interpreted as a separate pipelined request. A local low-privilege attacker can exploit this to split a single malformed request into two forwarded requests and receive an additional smuggled response without needing a vulnerable server.

CVE-2026-77802 is a medium severity vulnerability in Progress® Telerik® Fiddler® Classic for Windows prior to version 6.0.20262.10021. It involves HTTP request smuggling due to inconsistent handling of multiple conflicting Content-Length headers in the proxy request forwarding component. A local attacker with low privileges can exploit this to smuggle additional requests against certain non-compliant origin servers, potentially poisoning responses delivered to other users. The vulnerability arises because Fiddler forwards requests verbatim but frames the body using only the first Content-Length header, causing desynchronization. This can lead to response poisoning and unauthorized access to responses intended for other users.