Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion loop used for ordinary responses. The early return invokes handleUpgradeResponse, which copies the upstream headers to the client and normalizes only WebSocket-specific header names. An attacker who controls or compromises a proxied WebSocket upstream can therefore cause hop-by-hop headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, as well as headers named by Connection, to cross the proxy boundary. For HTTP/2 or HTTP/3 extended CONNECT, the upstream 101 response may be represented to the client as an ordinary successful response, increasing the chance that leaked headers are processed. This issue is fixed in version 2.11.5.
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors.
This issue affects Apache Sling Engine: before 3.0.4.
Users are recommended to upgrade to version 3.0.4, which fixes the issue.
CVE-2026-55614 is a medium-severity vulnerability in the openwrt uhttpd HTTP server. It involves improper handling of the Transfer-Encoding header in HTTP requests, where mixed-case transfer-coding tokens are accepted without proper processing. This leads to HTTP request smuggling and boundary desynchronization on keep-alive connections, allowing an attacker to manipulate how requests are parsed.
uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue.
uhttpd is a small HTTP server. In unpatched repository snapshots, `uh_ubus_data_send()` in `ubus.c` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. An initial segment completing a JSON object sets `du->jsobj`; a later segment takes the existing-object parse-error path and returns zero bytes consumed. The caller neither drains the remaining declared `Content-Length` nor sets `connection_close`. An HTTP request embedded in the unread body suffix is consequently processed as a new request on the same keep-alive connection. The reported reproducer returned a JSON-RPC parse error followed by a second HTTP response. This application-layer body-handler flaw is distinct from Transfer-Encoding header case handling and chunk-length state reset, and affects deployments enabling ubus, including the default OpenWrt configuration and potential proxy/CDN deployments. Repository patches 7b1bec45826bd78c8afc993435bdc0f1df2fe399 and b2285de129b9adc8b12f84f9a27c16c21f2b57a5 address this issue.
Starlet versions before 0.33 for Perl improperly send a body in responses to HEAD requests, causing corruption of subsequent responses on persistent or pipelined HTTP connections. This behavior can desynchronize proxies sharing connections across clients due to extra bytes being misinterpreted as the start of new responses. The issue is fixed in version 0.33.
CVE-2026-118264 is a critical HTTP request smuggling vulnerability in the labstack Echo Go web framework. It affects versions from 4.0.0 up to but not including 4.16.1, and from 5.0.0 up to but not including 5.4.1. The flaw arises in Echo's Proxy middleware, which improperly handles client WebSocket upgrade requests by selecting a raw tunnel before verifying if the upstream server accepted the upgrade. If the upstream rejects the upgrade with a keep-alive response, subsequent HTTP requests bypass Echo's router and route-specific middleware, potentially circumventing authentication or authorization controls enforced by Echo routes. This vulnerability requires a specific setup including an accessible proxy route, a cooperating rejected-upgrade response, and an upstream target lacking independent authorization. The issue is fixed in versions 4.16.1 and 5.4.1.
CVE-2026-103995 is a vulnerability in CPython where the response body and chunk parsing incorrectly handle non-hexadecimal or negative integers. This flaw can cause misinterpretation of HTTP response contents, potentially leading to HTTP request smuggling attacks. The issue affects all CPython versions prior to 3.16.0 and has been fixed in version 3.16.0. The vulnerability has a low severity score and no known exploits in the wild.
CVE-2026-114216 is an HTTP Request Smuggling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit versions from 1.12.4 up to but not including 1.14.0. The flaw arises because the chunked reader improperly parses chunk-size lines, allowing a specially crafted chunk extension with a bare LF to smuggle a second HTTP request past a front-end proxy. This can lead to the proxy and Bandit interpreting requests differently, potentially enabling unauthorized request smuggling attacks. Deployments without a front-end proxy are not affected. The issue is fixed in version 1.14.0.
CVE-2026-115823 is a critical HTTP request smuggling vulnerability in Starman versions before 0.4019 for Perl. The flaw arises because Starman sends response bodies for HEAD requests without chunked framing, causing desynchronization of responses on keep-alive connections. This leads to clients misinterpreting response bytes as the start of subsequent responses, potentially causing a front-end proxy to mismatch responses with requests.
CVE-2026-115877 is an HTTP request smuggling vulnerability in the Twisted framework prior to version 26.10.0rc1. The issue arises because twisted.web.http.HTTPChannel.headerReceived improperly handles bare carriage return or line feed characters in HTTP header values, allowing a hidden Content-Length header to be folded into another header. This causes a framing mismatch between the front-end and backend, enabling request smuggling that can bypass access controls, poison shared connections or caches, and expose clients to incorrect responses. The vulnerability is fixed in version 26.10.0rc1.
CVE-2026-112212 is a high-severity HTTP Request Smuggling vulnerability in GitLab CE/EE affecting versions from 18.3 up to but not including 19.3.6, 19.4 up to 19.4.3, and 19.5 up to 19.5.1. It allows an unauthenticated attacker to poison a shared cache's OAuth/OIDC discovery document, potentially redirecting authentication flows to an attacker-controlled server. This occurs due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses. The issue has been fixed in GitLab versions 19.3.6, 19.4.3, and 19.5.1.
Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contain a vulnerability that allows HTTP request smuggling via HEAD requests with Content-Length or Transfer-Encoding headers. This flaw is addressed in versions 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-111816 is a critical HTTP request/response smuggling vulnerability in Apache Traffic Server. The issue arises from the server forwarding a malformed 302 response that should have been rejected due to a parsing error. However, a Transfer-Encoding: chunked carve-out bypassed the rejection path, causing the server to store and serve a response that peers interpret differently. This discrepancy allows cache poisoning and response-framing desynchronization attacks. The vulnerability affects Apache Traffic Server versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2025-55702 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when a client sends a POST request with the Expect: 100-continue header and the origin server responds before reading the request body. This causes Apache Traffic Server to misinterpret the unread body as a new request, enabling an attacker behind a shared front-end proxy to smuggle requests past the front end and desynchronize responses for other users. The vulnerability affects multiple versions of Apache Traffic Server from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
CVE-2025-31699 is a high-severity HTTP request/response smuggling vulnerability in Apache Traffic Server. It occurs when the server returns an origin connection to the shared pool while the origin is still waiting on a request body that the client declared but never fully sent, including cases using Expect: 100-continue. This allows the origin to misinterpret subsequent requests as leftover body data, enabling attackers to smuggle requests past access controls, disrupt other users' requests, or poison the cache. The issue affects multiple versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and version 10.2.0. Fixed versions are 9.2.16, 10.1.5, and 10.2.1.
CVE-2026-86146 is an HTTP request smuggling vulnerability in Apache bRPC versions prior to 1.18.0. It arises from inconsistent parsing of HTTP/1.1 headers between bRPC and front-end proxies or load balancers, allowing attackers to smuggle requests and inject headers. The issue is fixed in version 1.18.0.
CVE-2026-93003 is a medium-severity vulnerability in the Eclipse Foundation's Eclipse ThreadX - NetX Duo Web add-on HTTP server. The server improperly processes HTTP request headers by scanning the entire request packet for header fields instead of stopping at the end of the header section. This flaw allows an attacker to place a header field name in the request body, causing the server to misinterpret it as a legitimate header and enabling HTTP request/response smuggling.
CVE-2026-111750 is a medium severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.4 use a pure Python HTTP parser that accepts ambiguous HTTP request framing, allowing an unauthenticated attacker to perform HTTP request smuggling when the application runs without standard wheel extensions or uses AIOHTTP_NO_EXTENSIONS. This issue is fixed in version 3.14.4.
CVE-2026-88092 is a critical HTTP request smuggling vulnerability in Microsoft ASP.NET Core 10.0 and other versions. It arises from inconsistent interpretation of HTTP requests, allowing unauthorized attackers to tamper with network traffic. The flaw affects multiple ASP.NET Core versions prior to their respective fixed releases. A high-severity fix is officially available from Microsoft.